Researchers Push Over 2 Million Updates to Remotely Disable Popcorn Time Updater That Could Fuel a Botnet

Dutch cybersecurity firm Eye Security has quietly disabled a dangerous auto-update component inside Time4Popcorn, an abandoned fork of the old Popcorn Time piracy app, by pushing more than 2 million remote updates to machines it does not own between November 2025 and March 2026. The underlying flaw, CVE-2026-30612, let the Updater.exe (Windows) and PT.updd (Mac) process fetch and install code over an unencrypted connection with SYSTEM/root privileges from abandoned, re-registerable web domains, affecting Time4Popcorn up to version 6.2.1.18 on Windows, 6.2.1.17 on Mac, and 3.5.0.173 on Android, with CISA scoring it 9.8 out of 10. Dubbed Operation IXIM, Eye Security registered the dead domains itself, saw roughly 50 requests per second from millions of hardware IDs representing an estimated 2.5–3 million Windows PCs and 250,000–350,000 Macs, and then served a harmless payload that only stops and disables the vulnerable update service, later handing the reclaimed domains to the Shadowserver Foundation. Because the rest of the app still runs on outdated, sandbox-free browser code and loads from other orphaned domains, Eye Security recommends fully uninstalling Popcorn Time rather than relying on the disabled updater alone.