Eye Security researchers have disabled the update mechanism of an abandoned Popcorn Time fork and sinkholed its domains.
A BitTorrent client that allowed users to view movies downloaded from the web, Popcorn Time was highly popular over a decade ago, but the project was abandoned in 2014. A legal alternative has been in the works since early 2025.
The vulnerable update mechanism targeted by Eye Security belongs to Time4Popcorn, a fork of the original that has been distributed under the name Popcorn Time.
Eye Security discovered that the abandoned updater is connecting to its remote servers over HTTP to request updates, and that many of the update domains have been abandoned, while others are owned by third parties and parked.
The updater runs in the background at system boot, does not feature code signing, and downloads and runs any executable its domain supplies.
After registering the abandoned domain popcorntimeupd.xyz, Eye Security observed millions of systems connecting to it. Systems also connected to other domains, and the company registered some of those as well.
Most of the identified systems were Windows (2.5-3 million), with the remaining running macOS (250,000-350,000) and Android (less than 200,000).
“Most clients are connecting from end-user ISPs spread across the world, but we’re also seeing connections from various government and military networks around the world. We’re also seeing a lot of clients connecting from corporate networks,” Eye Security reported. “It’s hard to draw conclusions from this, but we think it’s safe to say criminals would be very interested in many of these systems.”
The insecure updater connection exposed all these devices to potential traffic manipulation, where an attacker could serve their own malicious update that would be executed with System/root privileges. The vulnerability is tracked as CVE-2026-30612.
Because the project had been abandoned, there was no vendor to patch the underlying flaw via an update, and Eye Security took matters into its own hands: the researchers registered 15 domains that were not owned by a third party and pushed an update to entirely disable the flawed mechanism.
Eye Security began the operation in November 2025 and, by March 2026, it had served the fix to roughly 2 million systems, which translated into a 98% reduction of update requests to its domains.
However, the updates were supplied only to Windows and macOS systems. On Android, the process requires user interaction, and the updater is part of the application and cannot be independently disabled.
In late March, The Shadowserver Foundation took over the domains, and they remain sinkholed along with other domains that the Popcorn Time application was loading JavaScript code from (and which were abandoned as well).
The vulnerable updater can also be disabled manually. However, the application is built on a 2014 version of Chrome with no sandbox and should be completely removed.
“Our update only disabled the updater. The rest of the application is unchanged, so these risks remain for anyone who still uses Popcorn Time. We already created a proof of concept that executes calc.exe via JavaScript, so the risk is real. That’s why our advice is simple: uninstall it,” Eye Security notes.
Related: Maritime Coalition Launches Free Vulnerability Database for Ship and Port Systems
Related: PHP2Shell Exploitation Moves From Probes to Working Shells
Related: Attackers Exploit Third Arista VCO Zero-Day in Four Months
Related: Atlassian Patches 75 Flaws in Data Center and Server Products
