---
title: Abandoned Popcorn Time fork left millions of PCs and Macs one domain away from SYSTEM/root code execution; researchers pushed a fix that disabled the updater | ctxsec
url: https://ctxsec.com/items/time4popcorn-updater-cve-2026-30612-eye-sinkhole
description: ""
status: "confirmed (Eye Security advisory; NVD CVE-2026-30612, CISA-ADP CVSS 9.8); no patch, software abandoned; no exploitation reported"
published: 2026-10-24
---

> 

[← Cybersecurity News](/news) · [markdown](/items/time4popcorn-updater-cve-2026-30612-eye-sinkhole.md)

confirmed (Eye Security advisory; NVD CVE-2026-30612, CISA-ADP CVSS 9.8); no patch, software abandoned; no exploitation reported

2026-10-24

### Abandoned Popcorn Time fork left millions of PCs and Macs one domain away from SYSTEM/root code execution; researchers pushed a fix that disabled the updater

Eye Security found that **Time4Popcorn**, a widely installed fork of the Popcorn Time torrent client, runs a background updater that fetched updates over plain HTTP from abandoned domains and ran them without checking signatures, as **SYSTEM** on Windows and **root** on macOS (CVE-2026-30612; Windows <= 6.2.1.18, macOS <= 6.2.1.17, Android <= 3.5.0.173).

- After registering the update domain, Eye saw up to about 3 million Windows and 350,000 macOS clients checking in, including from corporate, government and military networks. Most looked installed and forgotten.
- Between November 2025 and March 2026 Eye used the same channel to send a remediation that only stopped and disabled the updater; it reports about 2 million downloads and a 98% drop in requests. The domains now sit with The Shadowserver Foundation.
- Android clients were not touched (updates need a user tap), and the app itself still runs a 2014 browser engine with no sandbox, so Eye says to uninstall it.

Details were presented at Hack.lu on Oct 22 and reported by BleepingComputer on Oct 23. See Threat Hunting for how to find it on your fleet.

Sources: [Eye Security: CVE-2026-30612, a vulnerability in Time4Popcorn (PopcornTime)](https://research.eye.security/cve-2026-30612-a-vulnerability-in-time4popcorn-popcorntime/) · [NVD: CVE-2026-30612](https://nvd.nist.gov/vuln/detail/cve-2026-30612) · [Hack.lu 2026 talk: Operation IXIM](https://pretalx.com/hack-lu-2026/talk/FAGXJE/) · [BleepingComputer (Oct 23)](https://www.bleepingcomputer.com/news/security/abandoned-popcorn-time-app-exposed-millions-of-device-to-rce-attacks/)