# Abandoned Time4Popcorn (Popcorn Time) insecure updater enables SYSTEM/root RCE via domain takeover (CVE-2026-30612)

> The Time4Popcorn updater polled abandoned, unregistered domains (e.g. popcorntimeupd.xyz) over an insecure channel and did not verify signatures on downloaded executables, so whoever registered the domain could push code that ran as SYSTEM (Windows) or root (macOS). Eye Security researchers registered the domains, found millions of live clients, and pushed a benevolent update that disables the updater; Android users remain exposed.

- **Published:** 2026-10-23T21:12:54Z
- **Last reviewed:** 2026-10-24T10:47:11.857Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4311
- **ID:** TL-2026-4311
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** MONITORING
- **Detections:** 9 · **IOCs:** 11 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-30612

## Description

Time4Popcorn is a fork of the abandoned Popcorn Time BitTorrent streaming application. Its update mechanism never stopped running, and millions of installations kept polling update domains that were no longer registered. During routine threat hunting, Eye Security (researcher Niels Teusink) registered one of these domains and saw requests arriving every second, with millions of unique hardware IDs observed over several months from residential ISPs and from corporate, government and military networks. BleepingComputer reports up to 3 million Windows client connections and 350,000 macOS client connections.

Reverse engineering of the closed-source Windows and macOS updater binaries showed that the updater connects to its update servers over an insecure channel (plain HTTP) and does not verify digital signatures on the executables it downloads. An attacker controlling the update domain, or able to manipulate the traffic, could deliver an arbitrary executable. On Windows the updater runs as the auto-starting 'Update Service' (Updater.exe) as NT AUTHORITY\SYSTEM; on macOS it is the privileged helper PT.updd, registered via a LaunchDaemon, running as root. Execution needs no user interaction. On Android the updater is embedded in the app and prompts for APK installation only when the app is opened, so user approval is required and it cannot be remediated remotely. NVD classifies the flaw as CWE-494 (Download of Code Without Integrity Check) with CVSS 3.1 base score 9.8.

Affected versions are Time4Popcorn for Windows 6.2.1.18 and earlier, macOS 6.2.1.17 and earlier, and Android 3.5.0.173 and earlier. Fixed builds that remove the vulnerable updater are Windows 6.2.1.19, macOS 6.2.1.18 and Android 3.5.0.174 per the CVE record aggregators, although the Eye Security write-up states that no vendor update is available because the software is abandoned. The application also embeds a roughly 2014-era Chrome engine with no sandbox, so the product stays unsafe even with the updater disabled.

Between November 2025 and March 2026 Eye Security deployed a 'benevolent update' payload to disable the updater remotely (no telemetry collection or file deletion), reporting about 2 million update downloads and a 98% drop in update-domain requests by 1 March 2026. The researchers registered 15 update-related domains in total, and the infrastructure is now sinkholed by The Shadowserver Foundation. Eye Security presented the work ('Operation IXIM') at Hack.lu on 22 October 2026. No malicious in-the-wild exploitation by threat actors is stated in the sources; the risk is that any party acquiring the abandoned domains could have built a botnet.

## MITRE ATT&CK

- T1583.001 Domains
- T1195.002 Compromise Software Supply Chain
- T1557 Adversary-in-the-Middle
- T1543.003 Windows Service
- T1543.004 Launch Daemon
- T1071.001 Web Protocols
- T1565.002 Transmitted Data Manipulation
- T1105 Ingress Tool Transfer
- T1204.002 User Execution

## Sources

- [Abandoned Popcorn Time app exposed millions of device to RCE attacks](https://www.bleepingcomputer.com/news/security/abandoned-popcorn-time-app-exposed-millions-of-device-to-rce-attacks/)
- [CVE-2026-30612: A vulnerability in Time4Popcorn / PopcornTime (Eye Security Labs)](https://labs.eye.security/cve-2026-30612-a-vulnerability-in-time4popcorn-popcorntime/)
- [NVD - CVE-2026-30612](https://nvd.nist.gov/vuln/detail/CVE-2026-30612)
- [Hack.lu 2026: Operation IXIM: Preventing a botnet of millions of PopCorn Time users](https://pretalx.com/hack-lu-2026/talk/FAGXJE/)
- [OpenCVE - CVE-2026-30612](https://app.opencve.io/cve/CVE-2026-30612)
- [SOCRadar IOC Radar - CVE-2026-30612](https://socradar.io/free-tools/ioc-radar/reports/cve-2026-30612-a-vulnerability-in-time4popcorn-popcorntime-e381acfba20c)
- [Time4Popcorn (vendor site referenced by NVD)](http://time4popcorn.com/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4311