Abandoned Popcorn Time app put millions of devices at risk
An abandoned Popcorn Time spin-off left millions of Windows and Mac devices exposed to a critical update flaw, researchers say.
An abandoned Popcorn Time spin-off could have given attackers a route to execute malware on millions of Windows and macOS devices. Security researchers found that Time4Popcorn’s updater continued contacting a defunct domain over unencrypted HTTP and accepted executable files without checking their digital signatures.12
How the updater became a security risk
Time4Popcorn was one of several Popcorn Time offshoots that remained installed on computers after the original service disappeared. Its updater was designed to retrieve new software from `popcorntimeupd.xyz`, but the update process did not verify whether a downloaded executable had been legitimately signed. Anyone who gained control of the abandoned domain could therefore have attempted to push malicious code to systems that still had the client installed.12
The flaw is tracked as CVE-2026-30612 and has a reported severity score of 9.8 out of 10. Eye Security, the researchers who investigated it, said the potential impact was severe because the updater was present on a large number of forgotten installations. The researchers observed connections from as many as 3 million Windows clients and 350,000 macOS clients, including devices linked to residential, government, military and corporate networks.12
Researchers shut down the update route
Eye Security registered the abandoned domain rather than using it to distribute malware. From November 2025 to March 2026, it used the update mechanism to stop and disable the vulnerable updater. The operation did not remove the app or collect host telemetry, according to the researchers. Requests to the domain subsequently fell by 98 per cent, although the remaining activity appeared to include Android devices that could still be exposed.1
The researchers later transferred the domain, along with 14 others, to the Shadowserver Foundation. Their advice is straightforward: uninstall Time4Popcorn and any similar abandoned Popcorn Time client rather than relying on the unofficial remediation to keep it safe.12
Our opinion
This is a useful warning about software that outlives its developer. An app does not need to be actively used to remain a security problem: if it still runs an updater, an abandoned server or domain can become an invitation to attackers. The researchers’ controlled intervention appears to have reduced the immediate risk, but it cannot turn an unsupported torrent client into trustworthy software. Removing it is the sensible fix, especially on machines that handle work, personal or administrative accounts.
Hero image: Photo by Kevin Ku on [Pexels](https://www.pexels.com/photo/data-codes-through-eyeglasses-577585/). It is an abstract cybersecurity visual and does not depict Popcorn Time or the affected updater.