Between November 2025 and March 2026, Eye Security, a Dutch cybersecurity firm, executed an operation to disable potentially dangerous software on millions of computers globally. This initiative aimed to neutralize a background updater associated with Time4Popcorn, an obsolete version of the Popcorn Time application, which could have been exploited to control these devices remotely.
What is Popcorn Time and Its Security Flaw?
Popcorn Time, a once-popular application for streaming pirated content, was originally shut down in 2014. However, versions like Time4Popcorn persisted, containing an updater that Eye Security identified as a significant risk. The updater, running on both Windows and Mac systems, continually sought updates via an unencrypted connection, allowing any registered web address to potentially send harmful software to these machines.
Eye Security discovered the updater during routine checks and took proactive measures by registering the updater’s web addresses. They termed this effort Operation IXIM and discussed it at Hack.lu in October 2026, revealing that over 3.8 million unique hardware IDs connected to the updater.
Mitigating the Risk
The updater’s vulnerability, identified as CVE-2026-30612, posed a severe threat enabling attackers to install ransomware or steal data. Eye Security’s solution was unconventional but effective: they used the updater’s mechanism to send a disabling update, ceasing its operation without altering files or collecting data.
This approach mirrors the 2021 Operation Ladybird, where Dutch authorities disabled the Emotet botnet. However, Eye Security emphasized that Popcorn Time users willingly installed the software, in contrast to Emotet victims.
Steps for Users and Future Outlook
Despite Eye Security’s efforts, Popcorn Time remains unsafe due to its outdated browser engine and unsecured connections. Users are advised to uninstall the application entirely. For those who prefer a manual approach, commands are available to disable the updater on Windows and Mac systems.
By March 2026, Eye Security had significantly reduced the updater’s reach, ultimately transferring control of the web addresses to the Shadowserver Foundation. This ensures these addresses are managed by a trusted entity, reducing the risk of malicious exploitation.
For cybersecurity professionals, monitoring networks for updater files and suspicious traffic is essential. Although no active exploitation has been reported, vigilance remains crucial as the flaw is not listed in the CISA’s known vulnerabilities catalog as of October 2026.
