Eye Security Disabled Popcorn Time Updater

Dutch security firm Eye Security says that between November 2025 and March 2026 it quietly, and without asking anyone’s permission, disabled a defunct auto-updater bundled with an old version of the film-streaming client Popcorn Time, after finding the component could have let anyone run code on millions of machines. The flaw, tracked as CVE-2026-30612, sat in the updater of a closed-source fork called Time4Popcorn; the legal “Popcorn Time” project that launched in 2025 is a different piece of software and, Eye says, its research does not apply to it.

The problem was that the updater never stopped working. Long after users had forgotten the app, Eye says, the background process kept polling domains that had since been abandoned, over unencrypted HTTP, ready to download and run whatever it was handed. “There was no code signing,” the firm wrote, and on Windows the update would execute “with high privileges (NT AUTHORITY\SYSTEM)”; on macOS it ran as root.

In brief

Eye Security says it disabled a defunct Popcorn Time (Time4Popcorn) auto-updater, CVE-2026-30612, that could have let anyone run code as SYSTEM on Windows or root on macOS.
No botnet was ever formed; Eye acted pre-emptively after seeing about 50 requests a second and over 3.8 million device IDs in six months.
It sent over 2 million update downloads, cut requests by 98%, handed 15 domains to The Shadowserver Foundation, and says anyone still running the app should uninstall it.

A forgotten updater that would run anything

Eye says it found the component during routine threat hunting, when it spotted an “Updater.exe” on a client’s laptop reaching for a domain nobody owned any more. After registering that domain, popcorntimeupd.xyz, it watched the traffic climb to “about 50 requests per second” and, over six months, “over 3.8 million” hardware IDs, roughly half on Windows, about 45% on macOS and under 5% on Android. Those counts were unreliable, Eye cautions, because many machines shared the same ID; it later estimated 2.5 to 3.0 million Windows hosts and 250,000 to 350,000 on macOS. Reverse-engineering the binary showed all an attacker needed was to serve a JSON pointer to an executable. On Android, where installing an update needs a tap from the user, Eye says it “did not deploy any updates to Android systems”. This is the same technique criminals use for zero-days that are exploited before a patch exists — except here the door was left permanently open.

Eye says it chose to act rather than stand by

Here is the uncomfortable part, and Eye does not dodge it: fixing the problem meant running its own code on strangers’ computers. The firm frames the decision as its own call, taken after consulting its legal team. Inaction was “the only real alternative we had”, it wrote, arguing the dead updater “wasn’t doing anything functional anyway, it was only creating risk”. It likens the move to Operation Ladybird, the police-led takedown that pushed a neutralising update to Emotet-infected PCs, while conceding the cases differ because Popcorn Time’s users had at least installed the app themselves. Its update, Eye says, only stops and disables the updater service — “no telemetry, no file deletion, nothing” — and it later handed its domains to a neutral foundation. The obvious question hangs over all of it: running code on someone’s machine without consent is precisely what the firm was trying to prevent, and benign intent is not a legal doctrine. The ambiguity is not theoretical. When Eye’s own fix landed on VirusTotal, much as security vendors scramble over any live threat, eleven antivirus engines flagged it as malware — an accurate description of code that reaches into a system and disables a service, whoever sent it.

No botnet formed, but the risk was real

Crucially, no botnet was ever assembled and no machines were infected; Eye acted before anyone hostile could seize the mechanism. Its campaign sent “over 2 million update downloads”, and by 1 March 2026 it was seeing about 5,000 update requests a day, “a 98% reduction”. Judging the residual interest too small to tempt a botnet operator, it stopped and, in late March, “transferred the 15 domains we owned to The Shadowserver Foundation”, a sinkholing role authorities more often play when they order flaws patched under attack. Some domains remain in other hands. The cleanup does not make the app safe: Eye says the client still runs on a 2014 Chrome engine with the sandbox off and loads JavaScript over HTTP from abandoned domains, so the only real remedy is Eye’s blunt closing advice — uninstall it.