Eye Security disables Time4Popcorn updater on over 2 million devices

Dutch security firm Eye Security says it delivered more than 2 million updates between November 2025 and March 2026 to disable a vulnerable background updater in Time4Popcorn, an abandoned Popcorn Time fork. The operation targeted an updater that could install code remotely with SYSTEM privileges on Windows and root privileges on macOS.

The weakness is tracked as CVE-2026-30612 and affects Time4Popcorn for Windows through version 6.2.1.18, macOS through 6.2.1.17, and Android through 3.5.0.173. The U.S. Cybersecurity and Infrastructure Security Agency assigned the issue a severity score of 9.8 out of 10.

Abandoned domains created a remote-code delivery path

Eye Security found the problem during a routine threat hunt after observing Updater.exe on a client laptop attempting to contact a domain that was no longer registered. The firm registered the domain and received roughly 50 requests per second. Over six months, the infrastructure recorded more than 3.8 million hardware IDs.

Those identifiers did not equate directly to individual machines. Some Windows systems shared an ID, while Mac identifiers could change. Eye Security therefore estimated that the updater remained active on 2.5 million to 3 million Windows computers and 250,000 to 350,000 Macs.

The updater launched when the computer started, fetched updates through an unencrypted connection and installed whatever it received without verifying the sender. Since the domains it contacted had been abandoned, a party registering an appropriate domain could potentially supply code to systems still making those requests. Eye Security said such access could be used to install ransomware, steal saved passwords or enlist a device in a botnet.

Operation IXIM used the update channel to stop itself

With no active vendor available to issue a fix, Eye Security sought legal advice and used the existing update mechanism to deliver a small package that stopped and disabled the updater. The package did not delete files or collect data. The company called the effort Operation IXIM and presented it at Hack.lu on October 22.

Antivirus tools initially detected the update, which disabled a Windows service, as malware. Eye Security reworked the package because blocking it would leave the vulnerable updater operating. By December 2025, it had updated more than 1 million systems and reduced traffic to its controlled domains by about 90 percent. By March 1, it was sending about 5,000 updates daily, a 98 percent reduction, before ending the campaign after more than 2 million downloads.

Removing the application remains the safer response

In late March, Eye Security transferred the 15 domains it controlled to the Shadowserver Foundation, which now operates them as sinkholes. The firm cautioned that other updater domains remain under outside ownership, leaving systems that contact them exposed. It found no evidence that those third parties were actively serving code.

Disabling the updater does not make Time4Popcorn safe. Eye Security said the application uses a 2014 browser engine with its security sandbox disabled, loads material over unencrypted connections and retrieves code from other abandoned domains. The firm built a working proof of concept but did not execute code through those paths.

On Windows, defenders can look for Updater.exe; on Macs, they can check for PT.updd and associated domain traffic. Windows and macOS users can disable the updater manually, but uninstalling Time4Popcorn is the safer business response because it removes the remaining application risks. On Android, the updater is integrated into the app, so removing the app is the only available fix.