Forgotten Time4Popcorn installs exposed to updater hijack
Security researchers found that an abandoned fork of Popcorn Time, Time4Popcorn, used an updater that fetched executables over plain HTTP without signature checks, creating a remote code execution risk tracked as CVE-2026-30612. After taking over the lapsed update domain, Eye Security delivered a cleanup payload that switched off the updater on affected Windows and macOS machines without collecting host data. The researchers observed millions of connections to the domain, though most appeared to come from forgotten installations.
Time4Popcorn was a Popcorn Time offshoot that paired a streaming-style interface with BitTorrent downloads. Its Windows and macOS updaters requested files over unencrypted HTTP from an abandoned domain and did not check signatures, so whoever controlled that domain could run code with high privileges.
Eye Security registered the domain and later fourteen related ones. From November 2025 to March 2026 it used the update channel to turn off the updater, without gathering host data or deleting files. Connections fell sharply, and domain control went to Shadowserver.
The exposure could affect people and organizations that installed Time4Popcorn and forgot it, including home users and networks in corporate, government, and military settings. Because the updater ran with elevated rights, a hijack could have enabled broad compromise, though the researchers’ cleanup may have reduced immediate risk. Android users and those still running the outdated embedded browser may remain at risk, so removal could be the safest practical step. The incident may also highlight how abandoned software can persist as hidden attack surface.