A dead movie app’s updater could answer to strangers on millions of Windows PCs until researchers shut it off

Time4Popcorn, an abandoned offshoot of the Popcorn Time streaming client, left an update mechanism running on millions of Windows computers that was willing to accept software from whoever controlled its update domain. The finding comes from the security firm Eye Security, and BleepingComputer reported it on October 23. The updater has since been switched off on Windows and macOS, but the app itself is still installed on machines that forgot about it.

Tech news in one quick read: Get the most interesting stories in startups, tech and programming, each with a short TLDR, in one daily email from TLDR.

Subscribe to TLDR →

We may earn a commission if you sign up.

Popcorn Time became known for pairing a Netflix-style interface with BitTorrent downloads of films and shows. The original project was abandoned for legal reasons and later relaunched as a legitimate streaming app, while forks such as Time4Popcorn kept the name, drew millions of users and then stopped being maintained. The unmaintained copies kept calling home to addresses that nobody was minding any longer.

A Popcorn Time fork that outlived its developers

Eye Security’s researchers registered the lapsed update domain and watched who showed up. According to BleepingComputer’s report on the research, the domain received up to 3 million Windows and 350,000 macOS client connections. The report is careful about what that figure means: it counts connections to one domain, not unique infected people, and none of the connecting machines appeared to be actively running the app. The software looked installed once and forgotten.

The traffic came from a wide mix of networks. BleepingComputer said the connections originated from residential internet providers and also from corporate, government and military networks, which is part of why the researchers treated a dormant movie app as a matter of real concern. Eye Security registered 14 more domains tied to the same service after the first, and an October 22 conference talk at Hack.lu 2026 by Eye Security’s Niels Teusink described the project as an effort to prevent a botnet of millions of Popcorn Time users.

CVE-2026-30612 and the unsigned updater

The weakness is tracked as CVE-2026-30612, published on August 27, 2026. The record describes an issue in the Time4Popcorn updater that lets a remote attacker execute arbitrary code, and it lists the affected builds as Windows version 6.2.1.18 and earlier, macOS 6.2.1.17 and earlier, and Android 3.5.0.173 and earlier. The same description appears in CERT.hr’s CVE listing. A severity score of 9.8 out of 10, the critical band, appears in the OpenCVE record as an enrichment added by the U.S. Cybersecurity and Infrastructure Security Agency program rather than by the assigning body.

Eye Security’s own write-up, published on June 11 by Teusink, explains the design problem in plain terms. The updater fetches updates over an insecure channel, and the software accepts what arrives without verifying a digital signature. Anyone able to supply the update could therefore have it run silently, with SYSTEM privileges on Windows and root privileges on macOS. On Android, the user is instead prompted to install a supplied package. The researchers noted that a separate, newer Popcorn Time project is not affected.

Eye Security said the stakes were obvious once the scale was visible. In the company’s words, as quoted by BleepingComputer, “the impact would be severe if this were to fall into the wrong hands.” The company stated that the ability to send an update was, in practical terms, the ability to run code on millions of systems.

How researchers shut the updater off

Instead of leaving the domain idle, Eye Security used the same update path to deliver a payload whose only job was to stop and disable the updater service. BleepingComputer reported that the work ran between November 2025 and March 2026, that the payload collected no data from the machines and deleted no files, and that it had to be modified during testing because antivirus products flagged it for disabling a service. Hack.lu’s description of the talk adds that the project raised ethical questions about pushing a well-meant update to machines whose owners never asked for it.

The results were measurable. Eye Security recorded 2 million update downloads after the deployment, and requests to its update domain dropped 98 percent by March 1, 2026. Ownership of the domain was then handed to the nonprofit Shadowserver Foundation, which now holds the infrastructure that strangers could once have claimed. The Windows and macOS exposure that drove the research is therefore largely historic, though the reports do not say how many machines make up the remaining two percent.

What remains exposed and the remedy

Android is the part that stays open. BleepingComputer said the updater there could not be disabled remotely, because an update requires the user to act. Eye Security’s write-up adds that the updater is built into the main app and only checks for updates when the app is opened, so it cannot be turned off separately. The report also noted that Time4Popcorn uses a severely outdated Chrome engine from 2014 that has no sandbox protections.

No patch exists, because nobody maintains the project. The remedy that both Eye Security and BleepingComputer give is to remove the software completely. Eye Security’s write-up describes stopping the updater service as only a partial mitigation, and the talk’s abstract concludes that the app is not safe to keep using even once the updater is disabled. Anyone who installed a Popcorn Time fork years ago and never removed it is the person this advice is aimed at.

This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.

Tech news in one quick read: Subscribe to TLDR →

We may earn a commission if you sign up.