Eye Security researchers have taken action to neutralize a significant security threat posed by the update mechanism of a defunct Popcorn Time fork, effectively taking control of its associated domains.
Background on Popcorn Time’s Popularity and Decline
Initially launched as a BitTorrent client for streaming movies from the internet, Popcorn Time gained immense popularity over ten years ago. However, the project was discontinued in 2014. Despite this, a legal alternative has been in development since early 2025, aimed at providing a legitimate solution for users.
The vulnerability in question is linked to Time4Popcorn, a variant of the original platform, which distributed updates under the Popcorn Time brand. Eye Security’s investigation revealed that this updater was reaching out to its servers via unsecured HTTP connections, with many domains being either abandoned or owned by external parties.
Details of the Vulnerability and Its Impact
The updater operates silently at system startup, lacks code signing, and can download and execute any files provided by its domains. Upon acquiring the dormant domain popcorntimeupd.xyz, Eye Security identified millions of systems connecting to it, including other domains they subsequently registered.
A significant portion of these devices were Windows systems (2.5-3 million), followed by a smaller number of macOS devices (250,000-350,000) and Android systems (fewer than 200,000). Notably, connections originated not only from regular internet users but also from government, military, and corporate networks globally.
This insecure connection posed the risk of malicious updates being installed with elevated privileges, tracked under CVE-2026-30612. With no active vendor to release a patch due to the project’s abandonment, Eye Security intervened by securing unclaimed domains and deploying an update to disable the flawed mechanism.
Measures Taken and Future Recommendations
Beginning in November 2025 and concluding by March 2026, Eye Security’s operation successfully disabled the updater on approximately 2 million systems, achieving a 98% reduction in update requests. This fix was applied to Windows and macOS, while Android devices require user involvement, as the updater cannot be independently deactivated.
In March, The Shadowserver Foundation assumed control of these domains, maintaining them in a sinkholed state alongside other abandoned domains previously used by the application for executing JavaScript code.
Users can also manually disable the vulnerable updater. However, the underlying software remains based on a 2014 version of Chrome lacking sandbox protection, necessitating complete removal to mitigate risks. Eye Security strongly advises uninstalling the application to avoid potential exploitations.
Related: Maritime Coalition Launches Free Vulnerability Database for Ship and Port Systems
Related: PHP2Shell Exploitation Moves From Probes to Working Shells
Related: Attackers Exploit Third Arista VCO Zero-Day in Four Months
Related: Atlassian Patches 75 Flaws in Data Center and Server Products
