Talk to an expert
PricingNewsTalk to an expert
Back to Newsroom
Threat Intel

Abandoned Popcorn Time Updater Left Millions of PCs Open to Takeover — 2M+ Updates Pushed to Switch It Off

A forgotten updater in the Time4Popcorn fork of Popcorn Time (CVE-2026-30612, CVSS 9.8) could let anyone controlling its abandoned domains run code on users' machines. With no vendor left to patch it, security researchers sent more than 2 million updates that disable it — but the app itself remains unsafe.

4T4Tify Team4Tify
Oct 25, 2026·5 min read
Abandoned Popcorn Time Updater Left Millions of PCs Open to Takeover — 2M+ Updates Pushed to Switch It Off

Abandoned Popcorn Time Updater Left Millions of PCs Open to Takeover

Popcorn Time, the BitTorrent-based app for streaming pirated films and TV shows, was officially shut down back in 2014. Its copies never really died. One of them, Time4Popcorn, still ships a background updater that quietly phones home to a set of web domains nobody maintains anymore — and that turned out to be a critical weakness, now tracked as CVE-2026-30612 with a CVSS score of 9.8.

Between November 2025 and March 2026, a Dutch security company took the unusual step of pushing more than 2 million updates to computers it did not own, with a single goal: switch that updater off.

What happened

The problem surfaced during a routine threat hunt, when a program named Updater.exe on a corporate laptop kept trying to reach one of those domains. The updater trusts whatever those addresses serve, so whoever controls them can run code on every machine still calling in. On a host with that kind of access, an attacker could deploy ransomware, steal stored passwords or enlist the computer in a botnet. A sample of the connecting systems included home users worldwide as well as machines on government, military and corporate networks — though the researchers cautioned that it is hard to draw firm conclusions from that sample.

Affected Time4Popcorn versions:

  • Windows up to and including 6.2.1.18
  • macOS up to and including 6.2.1.17
  • Android up to and including 3.5.0.173

With no vendor left to issue a fix, the researchers — after taking legal advice — registered the abandoned domains and used the updater against itself. Their update does one thing: it stops and disables the updater. It deletes no files and collects no data. The approach echoes the 2021 Emotet takedown, when Dutch police pushed an update to infected computers to neutralise the malware — with the difference that Popcorn Time users installed the app themselves.

Several antivirus engines initially flagged the update as malicious (fairly, since it disables a Windows service), which left the vulnerable updater running on those systems. The update was reworked until almost no engine flagged it. By December 2025 more than 1 million systems had been updated and traffic to the domains had dropped by about 90%; by early March it was down 98%, and the campaign was stopped. In late March the 15 domains the researchers controlled were handed to a non-profit that sinkholes abandoned and malicious domains.

Why it matters

The risk is not fully gone. Other domains the updater contacts are owned by third parties and were never taken over, so machines that reach them remain exposed. So far there is no sign anyone is serving malicious code through them — they appear parked or listed for sale — and the flaw has not been reported as exploited in the wild. That can change the moment someone buys one of those domains.

Disabling the updater also does not make the app safe. Popcorn Time runs on a 2014-era browser engine with its security sandbox turned off, loads content over unencrypted connections and pulls code from other abandoned domains — a path the researchers proved exploitable with a working proof of concept. On Android the updater is built into the app and could not be switched off remotely at all.

What to do

  • Uninstall Popcorn Time / Time4Popcorn on every platform. On Android, removal is the only fix.
  • If removal has to wait, disable the updater manually:
    • Windows: sc.exe stop "Update service" and sc.exe config "Update service" start= disabled
    • macOS: launchctl unload -w /Library/LaunchDaemons/PT.updd.plist
  • Hunt for it on your network: look for Updater.exe on Windows and PT.updd on macOS, and for DNS or web traffic to the updater's domains using the published indicators of compromise.
  • Enforce an application allow-list so unsanctioned or end-of-life software cannot land on managed endpoints in the first place.

Abandoned software with a live update channel is exactly the kind of quiet risk that slips past asset inventories. Our team's vulnerability scanning service is built to surface outdated and unsupported applications across your endpoints and servers, so issues like this are found and removed before someone else takes control of the update channel.

SHARE