Time4Popcorn (Popcorn Time fork): abandoned updater allowed RCE via hijacked update domain (CVE-2026-30612)
Severity: high · Patch status: partial · Since 2026-10-23 · CVE-2026-30612
Eye Security registered the abandoned popcorntimeupd.xyz domain used by the Time4Popcorn Popcorn Time fork, whose Windows and macOS updaters fetched executables over unencrypted HTTP without signature verification (CVE-2026-30612). Whoever controlled the domain could push updates executing code as SYSTEM on Windows or root on macOS; Eye observed up to 3 million Windows and 350,000 macOS clients, including corporate, government, and military networks, though users appeared inactive. Between November 2025 and March 2026 Eye used the mechanism to deliver a payload disabling the updater, cutting requests 98% by March 1, then transferred domains to the Shadowserver Foundation. No malicious exploitation is reported. Residual risk remains: Android users cannot be remediated remotely, and the app embeds an unsandboxed 2014-era Chrome engine; full removal is recommended.
What to do
- Search endpoints for the Time4Popcorn app and popcorntimeupd.xyz traffic; uninstall the app entirely, including on Android devices
- Check EDR/AV logs for any update or execution activity tied to popcorntimeupd.xyz or the Time4Popcorn updater
- If the app was ever run with elevated privileges, review affected hosts for signs of compromise
- Block the popcorntimeupd.xyz domain and related infrastructure at the perimeter
Sources
All live incidents on Threat Watch
