Researchers at Eye Security have disabled the update mechanism of an abandoned Popcorn Time fork and taken control of the domains it used.According to the company, several million systems were connecting to those addresses, with a risk of traffic manipulation.
Popcorn Time is a BitTorrent client that allowed users to watch movies downloaded from the web. Very popular, the project was abandoned in 2014. A legal alternative has been in development since the beginning of 2025. The vulnerability targeted by Eye Security concerns Time4Popcorn, a fork of the original application distributed under the name Popcorn Time.
Eye Security found that this update program, still active, queried its remote servers over HTTP, an unencrypted communication protocol. Several domains used for these updates have expired, while others belong to third parties and are merely parked, i.e., held without any genuine content.
Millions of machines affected
The program runs in the background at system startup, lacks code signing, and downloads then executes any executable file provided by its domain. An attacker able to intercept the connection could therefore deliver a malicious update, which would be executed with the system’s maximum privileges, called “System/root”. The vulnerability is referenced under the identifier CVE-2026-30612.
After registering the abandoned domain popcorntimeupd.xyz, Eye Security observed millions of systems connecting to it, as well as other domains the company also registered. The majority of identified devices ran Windows, between 2.5 and 3 million, followed by macOS, between 250,000 and 350,000, and Android, less than 200,000.
The researchers noted that these connections originated from Internet service providers worldwide, as well as from governmental and military networks, and corporate networks. “It is difficult to draw conclusions, but we think it is reasonable to say that criminals would be very interested in many of these systems,” says Eye Security.
A limited remote fix
With the project abandoned, no vendor could publish a patch. Eye Security therefore registered fifteen domains not owned by third parties and released an update that fully disables the faulty mechanism. According to the company, the operation began in November 2025 and, by March 2026, about 2 million systems had received this fix, representing a 98 % drop in update requests to its domains.
This fix was delivered only to Windows and macOS systems. On Android, its installation requires user action, and the update program is part of the app, unable to be disabled separately. At the end of March, the Shadowserver Foundation reclaimed the domains, which remain redirected to its servers, along with other domains from which the application loaded JavaScript code and which were also abandoned.
The update mechanism can be disabled manually, but Eye Security stresses that the application relies on a 2014 version of Chrome, without a sandbox, and should be completely removed. “Our update only disabled the update program. The rest of the application has not changed, so these risks remain for anyone still using Popcorn Time,” says the company, concluding: “Our advice is simple: uninstall it.”
