Popcorn Time vulnerability: 3 million PCs at risk

Remember Popcorn Time? The “Netflix for pirates” that made torrenting look like a streaming app, circa 2014? Of course you do. Some of you installed it, watched three movies, and never opened it again. Here’s the thing: it never stopped running. And until a few months ago, a security firm could have used it to execute code as SYSTEM on about three million Windows machines, with a single HTTP response.

That’s the Popcorn Time vulnerability, now tracked as CVE-2026-30612, and it’s one of the most instructive security stories I’ve read this year. Not because the bug is clever. Because it’s so dumb, and so widespread.

How the Popcorn Time vulnerability works

The affected app is Time4Popcorn, one of the many forks that grabbed the Popcorn Time name after the original project folded under legal pressure. Its Windows and macOS builds ship an auto-updater that phones home to a domain called popcorntimeupd.xyz. Over plain HTTP. With no signature check on whatever executable comes back.

Now, the people behind that fork vanished years ago. Which means the domain expired. Which means anyone with ten bucks and a registrar account could buy it and become the official update server for millions of forgotten installs. Running as SYSTEM on Windows, root on macOS. The ingredients for a botnet, delivered by the laziest supply chain attack imaginable.

The ones who bought it, thankfully, were researchers at Eye Security. Once they owned the domain, the traffic told the story: up to 3 million Windows clients and 350,000 Macs checking in. Home ISPs, sure, but also corporate networks, government networks, military networks. Nobody was actually watching anything. The app was just sitting there, dutifully asking a dead company for updates. “If we were able to send an update,” Eye wrote, “we could potentially get code execution on millions of systems.”

The fix was to hack everyone, politely

This is the part that will make some of you uncomfortable, and I get it. Eye didn’t have a vendor to contact. There’s no CISO at an abandoned piracy fork. So between November 2025 and March 2026 they used the vulnerable updater to push their own payload, one that simply stopped and disabled the updater. No telemetry, no file deletion, no data collection, according to them. About 2 million machines pulled it. By March 1, requests to the domain had dropped 98%. They then handed the domain to the Shadowserver Foundation, the non-profit that specialises in sinkholing this sort of thing, and registered 14 more domains tied to the service for good measure.

Funny detail: a few antivirus products flagged the fix as malware, because a program disabling a service looks exactly like a program disabling a service. They had to tweak the payload mid-campaign to get it through. The irony of security software blocking the only update that ever mattered is not lost on me.

Is pushing code onto millions of machines without consent defensible? I’d normally say no. Here I’ll make an exception, because the alternative was leaving the keys in a parked car on a street full of ransomware crews. If you want a counterexample of what happens when nobody intervenes, go read about the certificate authority that shipped a private key equal to 4. Trust infrastructure doesn’t fail loudly. It just quietly rots until someone notices.

What you should do today

Uninstall it. Seriously, go check. If Popcorn Time or Time4Popcorn is on any machine you own, or on your parents’ laptop, remove it. The remote fix only killed the updater; the app itself still embeds a Chrome engine from 2014 with no sandbox, which is basically a museum of exploits with a user interface. Android users got nothing at all, because mobile updates need a tap, so researchers couldn’t disable them remotely. Eye’s own words: the risk is “not fully eliminated”.

And the bigger lesson, the one for every piece of software you’ve ever installed: an auto-updater is a remote code execution feature you agreed to. It’s only safe as long as someone still pays for the domain.

Popcorn Time didn’t die. It just kept asking a ghost for instructions.