Eye Security Disables Vulnerable Updater for Abandoned Time4Popcorn
Researchers at Eye Security remotely disabled the vulnerable Time4Popcorn app updater through acquired update domains. The critical flaw could have enabled code execution with elevated privileges on Windows and macOS.
Security firm Eye Security has disclosed Operation IXIM, in which it remotely disabled the vulnerable Time4Popcorn updater on devices running the old Time4Popcorn application. The flaw, tracked as CVE-2026-30612, affects the abandoned client for Windows, macOS, and Android. The company recommends completely uninstalling the application because no standard vendor fix is available for it.
According to Eye Security, the updater communicated over an insecure channel. On Windows and macOS, it could execute delivered code without user interaction with SYSTEM or root privileges, respectively. The vulnerability has a CVSS score of 9.8, indicating critical severity.
Time4Popcorn updater and affected versions
CVE-2026-30612 affects Time4Popcorn for Windows through version 6.2.1.18, for macOS through version 6.2.1.17, and for Android through version 3.5.0.173. The risk primarily concerns old installations that may have remained on personal computers or in corporate inventories even after the project was abandoned.
On Windows and macOS, the problem was the automatic update mechanism: insufficiently secured communication created a path through which code could be delivered and executed with elevated privileges. On Android, available information indicates that user interaction is required to execute delivered content.
More than two million disabling updates
Eye Security says that from November 2025 through March 2026, it delivered more than two million updates. These stopped and disabled the updater on devices that communicated with domains acquired by the company. This was an intervention in the update infrastructure of an abandoned application, not a routine fix issued by the original vendor.
However, the number is not an independently confirmed inventory of unique machines. The estimate is based on telemetry and identifiers observed by the company. In addition, not all installations necessarily received a disabling update: some update domains were not under Eye Security’s control, and on Android the intervention requires user interaction.
Disabling it is not a substitute for uninstalling it
Remotely disabling the updater does not remove other security risks in Time4Popcorn. Eye Security warns about outdated application components as well as unencrypted content loading. It therefore recommends that users remove the client rather than rely solely on the disabled update mechanism.
Organizations looking for remaining installations can, according to the published findings, check for the Updater.exe artifact, the Update Service service, and the macOS component PT.updd. The presence of these items is particularly relevant on older devices where the application may have remained outside standard software management.
Available information does not confirm that attackers exploited CVE-2026-30612 in real-world attacks before Eye Security’s intervention. The publicly described information covers the flaw’s severity and proof of concept. Further developments may show whether CISA or other authorities list the vulnerability among actively exploited flaws, whether evidence of earlier exploitation emerges, and what coverage remained for unacquired domains and Android devices.
Time4Popcorn should also be distinguished from the newer legitimate project that uses the name Popcorn Time. The disclosed vulnerability and Operation IXIM concern the specific abandoned Time4Popcorn client.
Sources
- Eye Security – Primarily confirms the vulnerable updater, affected platforms, privileged code execution, the absence of a fix, and the recommendation to uninstall it.
- BleepingComputer – Corroborates the operation’s disclosure, more than 2 million disabling updates delivered, the scope of estimated connections, and continuing risks.
- The Hacker News – Corroborates the timeline of Operation IXIM, the transfer of domains to the Shadowserver Foundation, and the absence of publicly confirmed exploitation.
Verified and updated: October 24, 2026 15:21
