Popcorn Time fork Time4Popcorn: unsigned HTTP updater let anyone push code to millions of devices (CVE-2026-30612)
Time4Popcorn (Popcorn Time fork) for Windows, macOS, Android
Eye Security found that Time4Popcorn, an abandoned Popcorn Time fork, fetched updates over plain HTTP and ran unsigned executables, so whoever controlled the update endpoint or the network path could run code as SYSTEM on Windows or root on macOS. Researchers saw about 3 million Windows and 350,000 macOS clients checking in and disabled the updater remotely; Android clients stay exposed. There is no fix: uninstall the app.
Why this severity: Code execution as SYSTEM/root via the update channel; ~3.35M desktop clients; no vendor fix
- Started
- Oct 23, 2026
Affected
- All Time4Popcorn versions (abandoned)
Fixed in
No fixed release yet
Timeline2
Eye Security discloses CVE-2026-30612; the desktop updater was disabled remotely, Android remains exposed, and users are told to uninstall.
Eye Security details Operation IXIM: from Nov 2025 to Mar 2026 it pushed an update that only stops and disables the updater to over 2 million downloads (98% fewer update requests by March), then handed its 15 update domains to The Shadowserver Foundation. Some update domains are still held by third parties, and the app itself (a 2014 Chrome engine with the sandbox off, loading JavaScript over HTTP) remains unsafe, so uninstall it.
News & write-ups4
- Operation IXIM: Preventing a botnet of millions of Popcorn Time usersEye Security · Oct 22, 2026 · Write-up
- CVE-2026-30612: A vulnerability in Time4Popcorn (PopcornTime)Eye Security · Write-up
- Abandoned Popcorn Time app exposed millions of devices to RCE attacksBleepingComputer · Oct 23, 2026
- Abandoned Popcorn Time apps had to be disabled to prevent a zombie armyThe Verge
Get an email when a new major security incident drops. No spam, unsubscribe any time.
