An abandoned Popcorn Time fork left millions of computers with a dangerous back door—and security researchers had to take control of its update system to close it. The vulnerable software, known as Time4Popcorn, continued checking in from Windows, macOS, and Android devices even though its development had ended years ago. Researchers’ emergency shutdown of the dormant updater prevented a forgotten piracy app from becoming the foundation for a huge botnet.
Eye Security identified the flaw as CVE-2026-30612. Time4Popcorn’s updater contacted abandoned servers over an unencrypted connection, creating an opportunity for anyone who could seize a lapsed domain or interfere with network traffic to send a malicious replacement. On Windows and macOS, those updates could install and run without user approval with SYSTEM or root-level privileges—the kind of access that could enable ransomware, password theft, surveillance, or remote control. Eye Security’s technical disclosure confirms that the update component affected all three platforms, although the attack path differed on Android.
The scale made the discovery especially alarming. Independent reporting indicates that Eye Security observed connections from as many as three million Windows installations and roughly 350,000 macOS systems. The researchers registered one of the abandoned update domains and used it to distribute a benign update that disabled the vulnerable updater, delivering more than two million updates in the process.
That fix does not make the application safe to keep installed. The app itself reportedly contains a Chromium-based browser engine dating from 2014, lacks modern sandbox protections, and can load content or scripts through insecure infrastructure. On Android, the updater is built into the main application and cannot be remotely switched off in the same way; users must approve an update prompt, but the safest response remains uninstalling Time4Popcorn altogether.
The incident is a sharp warning about software that outlives its developers. Popcorn Time became famous by presenting BitTorrent-based movie and television streaming in a Netflix-like interface, but its convenience also encouraged users to install unofficial builds and leave them running long after active maintenance stopped. Abandoned domains, unsigned update packages, and privileged background services can turn that kind of forgotten installation into an attractive supply-chain target.
Users who still have a Time4Popcorn or similarly branded Popcorn Time build should remove it rather than rely on the researchers’ intervention. Eye Security also cautioned that a newer project using the Popcorn Time name, launched in 2025 as a legal alternative, is separate from the vulnerable software examined in this disclosure.
