Eye Security reports disabling Time4Popcorn desktop updaters
Time4Popcorn’s abandoned update system could give an attacker extensive control over a computer. Eye Security says it disabled desktop updaters to close that route.
Loading… Բեռնվում է…
Time4Popcorn’s abandoned update system could give an attacker extensive control over a computer. Eye Security says it disabled desktop updaters to close that route.
Eye Security says it remotely stopped and disabled vulnerable Windows and macOS updaters in the abandoned Time4Popcorn app between November 2025 and March 2026. The operation addressed an update mechanism that could have let attackers run code with extensive control over users’ computers, BleepingComputer reported on October 23, 2026.
Time4Popcorn is a fork—a separately developed version—of Popcorn Time, an app that combined video viewing with BitTorrent file-sharing downloads. Although Time4Popcorn had been abandoned, its desktop updaters still contacted its former update domain, popcorntimeupd.xyz.
The flaw, tracked as CVE-2026-30612, combined two weaknesses. The updaters contacted the domain over unencrypted HTTP connections and accepted executable files without checking digital signatures, which help verify a file’s origin and whether it has changed.
Someone controlling the update domain could supply code that ran as SYSTEM on Windows or root on macOS. Those are highly privileged accounts, giving the supplied code extensive control over the computer.
Eye Security discovered the risk after registering the abandoned update domain. The firm reported the following client connections; these are connection figures, not established counts of distinct vulnerable devices.
| Platform | Reported client connections |
|---|---|
| Windows | Up to 3 million |
| macOS | Up to 350,000 |
The researchers registered 14 more domains associated with the service and used the vulnerable update mechanism to deliver code that stopped and disabled the updater. Eye Security said its code collected no host data or telemetry and deleted no files. It also said it modified the code during testing to evade antivirus products that flagged it for disabling a service.
Eye Security reported two million remediation-update downloads and a 98% decline in requests to its update domain by March 1, 2026. These download and request figures do not establish how many distinct computers were repaired.
After the operation, domain ownership passed to The Shadowserver Foundation, a nonprofit security organization, BleepingComputer reported.
The researchers warned that Android users remained exposed. Installing an update on Android required user interaction, so they could not remotely disable the mobile updater.
Time4Popcorn also uses a Chrome browser engine from 2014 without sandbox protections—the isolation intended to limit what browser code can access. Researchers warned that this outdated component could still provide a route for attacks after the desktop updater was disabled. BleepingComputer recommends removing Time4Popcorn entirely.
The W27 keeps the Galaxy Z Fold 8 Ultra’s core hardware, with dark-red or dark-blue finishes, golden accents and 16GB of working memory in both storage versions.
2 min
The satellite operator expects access to more than twice OneWeb’s current bandwidth in return for spending in 2027–2034, with initial IRIS² services expected from 2030.
3 min
The black, gold and green edition follows September’s sold-out preorders. Nintendo’s replenished launch-day stock also quickly sold out.
1 min