Researchers Defused a Popcorn Time Updater on Millions of PCs
Eye Security found Time4Popcorn's abandoned updater would run any file as SYSTEM or root, registered its domain and used it to switch the updater off. Android users remain exposed.
Researchers found an abandoned Popcorn Time fork still phoning home on millions of computers, and quietly switched it off before a criminal could take over. BleepingComputer reports that the Windows and macOS updaters in Time4Popcorn checked an abandoned domain over plain HTTP and ran whatever it sent back, with full system rights and no signature check. Eye Security registered the domain, logged up to 3 million Windows and 350,000 Mac client connections, and spent November 2025 to March 2026 using the updater to disable itself.
For defenders
CVE: CVE-2026-30612, rated CVSS 3.1 9.8 in NVD (missing download integrity check). NVD lists Time4Popcorn for Windows up to 6.2.1.18, macOS up to 6.2.1.17 and Android up to 3.5.0.173. No vendor fix exists: the project is dead. No in-the-wild exploitation has been reported.
How it worked: the updater fetched a JSON file over HTTP and launched the linked executable as NT AUTHORITY\SYSTEM on Windows or root on macOS. Eye Security found it during a threat hunt when Updater.exe kept calling an unregistered domain. Connections came from homes but also corporate, government and military networks.
The fix they pushed: on Windows, a binary that stopped and disabled the update service; on macOS, an unload of the PT.updd launch daemon. Eye Security says it collected no telemetry and deleted no files. Update requests fell 98% by March 1. The team registered 15 related domains and handed them to The Shadowserver Foundation in late March; some others are still in third-party hands.
Still exposed: Android, where updates need a tap and couldn’t be disabled remotely. The app itself also runs a 2014 Chromium engine with the sandbox off and loads JavaScript from abandoned domains, and Eye Security built a proof of concept that pops a program through it. The current popcorntime.app project isn’t affected.
C:\Program Files\Popcorn Time\Updater.exe
/Library/PrivilegedHelperTools/PT.upddpopcorntimeupd[.]xyz
popcorntime-upd[.]xyz
popcorntime-update[.]xyz
updatepopcorntime[.]xyz
updpopcorntime[.]xyz
time4popcorn[.]info
besttime4popcorn[.]info
goldtime4popcorn[.]info
itspopcorntime[.]info
mypopcorntime[.]info
pct-upd[.]info
pctupd[.]info
popcornforever[.]info
popcorngoldtime[.]info
realpopcorntime[.]info
sunnypopcorn[.]info
t4p-upd[.]info
time2popcorn[.]info
upd-pct[.]info
updpct[.]infoWhat it means for you
If you installed Popcorn Time years ago (the Time4Popcorn version) and forgot about it, a hidden updater may still be running on your computer. It could have let anyone who bought the old web address install anything they liked. Researchers shut most of those updaters off, but the app is still unsafe to use. The researchers’ advice is simple: uninstall it.
Do this now
- Uninstall Popcorn Time or Time4Popcorn from every computer and phone. Check that the Updater.exe or PT.updd file is gone afterward.
- On Android, delete the app and don’t approve any update prompt it shows.
- Security teams: search endpoints for the two files and DNS logs for the domains above, and flag both files as unwanted software.
CVE at a glance
- CVSS
- 9.8 Critical (v3.1)
- EPSS
- 0.4% chance of exploitation in the next 30 days (higher than 36.4% of CVEs)
- Exploited in the wild
- Not on CISA’s KEV list
- Public exploit
- None reported in public exploit databases
Data from NVD, FIRST EPSS and CISA KEV, refreshed automatically. We report whether public exploit code exists but never link to it: fake proof-of-concepts that infect researchers are common.