Time4Popcorn updater flaw exposed millions to RCE (CVE-2026-30612)

Researchers at Eye Security found that Time4Popcorn — an abandoned fork of the Popcorn Time BitTorrent client — shipped an updater that could be turned into remote code execution on millions of machines, then quietly neutralized it. The primary write-up is Eye Security's "Operation Ixim"; BleepingComputer reported it October 23. The flaw is tracked as CVE-2026-30612.

What the bug does

Time4Popcorn's Windows and macOS updaters fetched updates over unencrypted HTTP and installed executables without checking digital signatures. Anyone who controlled the update domain could push arbitrary code and have it run as SYSTEM on Windows or root on macOS — full control, no user interaction. Eye Security gained that position simply by registering the abandoned update domain popcorntimeupd.xyz, which the dead project had let lapse.

Scale

Across the registered domain, Eye observed up to 3 million Windows and 350,000 macOS client connections still phoning home for updates — millions of machines running an abandoned app with a wide-open auto-updater. None of the observed clients appeared to be actively using the software; they were simply still installed and still checking in.

What Eye Security did

Rather than weaponize the access, Eye used the updater to push code that stopped and disabled it. Per the write-up, the payload collected no host data or telemetry and deleted no files. The operation ran between November 2025 and March 2026; Eye reports around 2 million update downloads, and requests to its domain fell 98% by March 1. Domain ownership was then handed to The Shadowserver Foundation.

Two gaps remain:

• Android clients could not be fixed remotely — updates there require user interaction.
• The app bundles a 2014-era Chrome engine with no sandbox, so even patched of this issue it is a liability.

Action checklist

1. Uninstall Time4Popcorn / Popcorn Time forks on any managed endpoint. There is no maintainer and no supported update path; removal is the fix.
2. Android users: remove it by hand — the remote mitigation did not reach Android.
3. Block popcorntimeupd.xyz egress and alert on it; a beacon to it means a still-installed, still-vulnerable client.
4. Scan for the bundled outdated Chromium engine as part of the same cleanup — it is unpatched by design.

Context

This is a clean example of abandonware as supply chain: software nobody maintains, still installed on millions of machines, still trusting an auto-updater whose domain anyone can buy for a few dollars. The vulnerability class — HTTP updates, no signature check — is ancient and well understood, which is exactly why it survives in dead projects that never got the memo. Eye Security chose to defuse it; the next person to register a lapsed updater domain may not. If you let users install unmanaged media apps, their abandoned updaters are your attack surface.