An abandoned copy of Popcorn Time, the app used to stream pirated movies and shows, left millions of computers exposed for years. With nobody left to maintain it, a Dutch security firm decided to switch the problem off on its own.
An updater that obeyed anyone
The program is called Time4Popcorn. According to The Hacker News, its background updater checked for new versions over an unencrypted connection and installed whatever it received, without verifying who sent it. Worse, it ran with the system’s highest permission level: SYSTEM on Windows and root on Mac.
The flaw is tracked as CVE-2026-30612 and rated 9.8 out of 10 by the US agency CISA. There was another aggravating detail: the web addresses the updater called had been abandoned. Anyone who registered them could have sent code to every computer still calling those addresses.
Who acted and how
Eye Security, a Dutch firm, found the updater during an investigation on a client’s laptop. With no vendor left to patch the software, Eye pushed its own update, named Operation IXIM, that only stops and disables the updater. It deletes no files and collects no data.
The numbers show the scale. The updater’s requests carried more than 3.8 million hardware IDs, and the firm estimates between 2.5 and 3 million Windows PCs and 250,000 to 350,000 Macs. In total, more than 2 million update downloads were served. In March, Eye transferred the domains it controlled to the Shadowserver Foundation.
The risk that never materialized
Whoever controlled the updater could have installed ransomware, stolen saved passwords or enrolled the machines in a botnet, a network of computers controlled remotely for attacks. Eye saw home users worldwide, plus machines on government, military and corporate networks. It found no evidence that anyone else used those addresses to push code, but some remain in outside hands, and machines still reaching them stay exposed.
How to protect yourself
- Uninstall Popcorn Time. That is Eye’s recommendation. Disabling only the updater leaves the rest of the app, which is also unsafe: it runs on a 2014 browser engine with its sandbox off.
- On Android, remove the app. The updater cannot be turned off separately, and Eye did not push an update to that version.
- To stop only the updater on Windows, open Command Prompt as administrator and run
sc.exe stop "Update service"and thensc.exe config "Update service" start= disabled. - Change passwords saved in your browser if the program stayed installed for a long time, as a precaution.
- Avoid abandoned software. Unmaintained programs get no fixes, and this forgotten updater is the proof.
