# Popcorn Time fork Time4Popcorn: unsigned HTTP updater let anyone push code to millions of devices (CVE-2026-30612) · pwn.watch > Eye Security found that Time4Popcorn, an abandoned Popcorn Time fork, fetched updates over plain HTTP and ran unsigned executables, so whoever controlled the update endpoint or the network path could run code as SYSTEM on Windows or root on macOS. Researchers saw about 3 million Windows and 350,000 macOS clients checking in and disabled the updater remotely; Android clients stay exposed. There is no fix: uninstall the app. Page: https://pwn.watch/i/popcorn-time-time4popcorn-updater-cve-2026-30612 · generated 2026-10-24T08:44:16.553Z ## Status - Severity: high · status: live · patch: unpatched - Product: Time4Popcorn (Popcorn Time fork) for Windows, macOS, Android - Started: 2026-10-23 - CVEs: CVE-2026-30612 - Affected: All Time4Popcorn versions (abandoned) ## Follow this incident - RSS (one item per update): https://pwn.watch/i/popcorn-time-time4popcorn-updater-cve-2026-30612/feed.xml - JSON Feed: https://pwn.watch/i/popcorn-time-time4popcorn-updater-cve-2026-30612/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/popcorn-time-time4popcorn-updater-cve-2026-30612.json - This file: https://pwn.watch/i/popcorn-time-time4popcorn-updater-cve-2026-30612/llms.txt ## Updates (newest first) - 2026-10-23: Eye Security discloses CVE-2026-30612; the desktop updater was disabled remotely, Android remains exposed, and users are told to uninstall. (https://research.eye.security/cve-2026-30612-a-vulnerability-in-time4popcorn-popcorntime/) - 2026-10-22: Eye Security details Operation IXIM: from Nov 2025 to Mar 2026 it pushed an update that only stops and disables the updater to over 2 million downloads (98% fewer update requests by March), then handed its 15 update domains to The Shadowserver Foundation. Some update domains are still held by third parties, and the app itself (a 2014 Chrome engine with the sandbox off, loading JavaScript over HTTP) remains unsafe, so uninstall it. (https://labs.eye.security/operation-ixim-preventing-a-botnet-of-millions-of-popcorn-time-users/) ## Fix brief # Security brief: Popcorn Time fork Time4Popcorn: unsigned HTTP updater let anyone push code to millions of devices (CVE-2026-30612) Source: https://pwn.watch/i/popcorn-time-time4popcorn-updater-cve-2026-30612 · status: live · severity: high · updated Oct 24, 2026, 07:25 UTC ## Patch status **UNPATCHED: no fixed release yet. Apply mitigations and watch for updates.** ## What it is Eye Security found that Time4Popcorn, an abandoned Popcorn Time fork, fetched updates over plain HTTP and ran unsigned executables, so whoever controlled the update endpoint or the network path could run code as SYSTEM on Windows or root on macOS. Researchers saw about 3 million Windows and 350,000 macOS clients checking in and disabled the updater remotely; Android clients stay exposed. There is no fix: uninstall the app. Severity detail: Code execution as SYSTEM/root via the update channel; ~3.35M desktop clients; no vendor fix - Product: Time4Popcorn (Popcorn Time fork) for Windows, macOS, Android - CVE / advisory ids: CVE-2026-30612 ## Affected versions - All Time4Popcorn versions (abandoned) ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix No fixed version is listed. Follow the vendor advisory below. ## Mitigations The data marks this as unpatched. Until every affected component is fixed, apply the vendor mitigations from the advisories below (restrict network exposure of the affected service, disable the vulnerable feature if the advisory allows). ## Specific notes No patched version exists. Uninstall Time4Popcorn on Windows, macOS and Android. ## Latest updates - Oct 23, 2026: Eye Security discloses CVE-2026-30612; the desktop updater was disabled remotely, Android remains exposed, and users are told to uninstall. - Oct 22, 2026: Eye Security details Operation IXIM: from Nov 2025 to Mar 2026 it pushed an update that only stops and disables the updater to over 2 million downloads (98% fewer update requests by March), then handed its 15 update domains to The Shadowserver Foundation. Some update domains are still held by third parties, and the app itself (a 2014 Chrome engine with the sandbox off, loading JavaScript over HTTP) remains unsafe, so uninstall it. ## Write-ups & news - [Operation IXIM: Preventing a botnet of millions of Popcorn Time users](https://labs.eye.security/operation-ixim-preventing-a-botnet-of-millions-of-popcorn-time-users/) - [CVE-2026-30612: A vulnerability in Time4Popcorn (PopcornTime)](https://research.eye.security/cve-2026-30612-a-vulnerability-in-time4popcorn-popcorntime/) - [Abandoned Popcorn Time app exposed millions of devices to RCE attacks](https://www.bleepingcomputer.com/news/security/abandoned-popcorn-time-app-exposed-millions-of-device-to-rce-attacks/) - [Abandoned Popcorn Time apps had to be disabled to prevent a zombie army](https://www.theverge.com/tech/1017914/popcorn-time-piracy-botnet-avoided) --- Machine-readable: https://pwn.watch/i/popcorn-time-time4popcorn-updater-cve-2026-30612.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.