Eye Security remotely disables vulnerable Time4Popcorn updater (CVE-2026-30612) exposing millions of devices to RCE
Researchers at Eye Security neutralized a flaw in the abandoned Time4Popcorn app, a fork of the Popcorn Time BitTorrent client, that let whoever controlled the update domain execute code with elevated privileges. The flaw, tracked as CVE-2026-30612, affects the Windows and macOS updaters. After registering the lapsed domain popcorntimeupd.xyz, Eye observed up to 3 million Windows and 350,000 macOS client connections, including from corporate, government and military networks. Between November 2025 and March 2026 the researchers used the update mechanism itself to push a remediation payload that disabled the updater. Domain ownership was then handed to The Shadowserver Foundation. Residual risk remains, notably for Android users.
Entenda a falha
A vulnerabilidade
CVE-2026-30612 is a flaw in the Windows and macOS updaters of Time4Popcorn, an abandoned fork of the Popcorn Time BitTorrent client. The updaters fetched updates from popcorntimeupd.xyz over unencrypted HTTP and accepted executables without verifying digital signatures. Whoever controlled that domain, or could tamper with the HTTP traffic, could run code as SYSTEM on Windows and as root on macOS. The articles give no affected version numbers and no vendor fix, since the app is abandoned. Android users remain exposed because an update needs user interaction and the updater could not be disabled remotely. The app also embeds a 2014 Chrome engine with no sandbox, which could be exploited.
Como funciona
At startup or on its update check, the updater contacts popcorntimeupd.xyz over plain HTTP and asks for an update. The server's response carries an executable, which the updater downloads and runs with the privileges of the updater itself, SYSTEM on Windows or root on macOS. It goes wrong because the updater never checks that the file really comes from the developer, so any content returned by the domain, or injected into the unencrypted traffic, is treated as a legitimate update.
Por que é vulnerável
The root cause is an insecure update design: transport over unencrypted HTTP and no signature verification of the downloaded executable. The trust placed in a single domain made things worse, because the project was abandoned and the domain lapsed, so it could be registered by anyone. No fix was released. Eye Security instead used the flawed mechanism itself to push a payload that stopped and disabled the updater.
Como foi descoberta
Eye Security researchers found the risk after registering the lapsed domain popcorntimeupd.xyz and seeing up to 3 million Windows and 350,000 macOS client connections, from residential ISPs and from corporate, government and military networks. The clients looked installed and forgotten. Eye then registered 14 more related domains and, between November 2025 and March 2026, delivered a remediation payload through the update mechanism. It collected no telemetry and deleted no files, and had to be modified to avoid antivirus detections. Requests fell 98% by March 1, and the domain was handed to The Shadowserver Foundation.
Explicação gerada por IA a partir da matéria e dos artigos, em 23/10/2026 18:15.
Detalhes técnicos
- The updaters contacted popcorntimeupd.xyz over unencrypted HTTP and accepted executables without verifying digital signatures.
- An attacker controlling the domain or manipulating the HTTP traffic could achieve code execution as SYSTEM on Windows and as root on macOS.
- Eye registered 14 additional domains tied to the service. Its payload collected no host data or telemetry and deleted no files. It had to be modified during testing to evade antivirus products that flagged it for disabling a service.
- After remediation, Eye recorded 2 million update downloads, and requests to the update domain dropped by 98% by March 1.
- Connections appeared to come from installed-and-forgotten instances, with no active use.
- Android users remain exposed because updating requires user interaction and the updater could not be disabled remotely.
- The app also embeds a severely outdated 2014 Chrome engine with no sandbox, which could be exploited.
Remediação
- Uninstall Time4Popcorn from all systems, including Android devices.
- Hunt for the app on corporate, government and military endpoints and for traffic to popcorntimeupd.xyz.
Linha do tempo
-
Eye Security remotely disables vulnerable Time4Popcorn updater (CVE-2026-30612) exposing millions of devices to RCE
ler a análise desta fonte ocultar
Researchers at Eye Security neutralized a flaw in the abandoned Time4Popcorn app, a fork of the Popcorn Time BitTorrent client, that let whoever controlled the update domain execute code with elevated privileges. The flaw, tracked as CVE-2026-30612, affects the Windows and macOS updaters. After registering the lapsed domain popcorntimeupd.xyz, Eye observed up to 3 million Windows and 350,000 macOS client connections, including from corporate, government and military networks. Between November 2025 and March 2026 the researchers used the update mechanism itself to push a remediation payload that disabled the updater. Domain ownership was then handed to The Shadowserver Foundation. Residual risk remains, notably for Android users.
Technical Details
- The updaters contacted popcorntimeupd.xyz over unencrypted HTTP and accepted executables without verifying digital signatures.
- An attacker controlling the domain or manipulating the HTTP traffic could achieve code execution as SYSTEM on Windows and as root on macOS.
- Eye registered 14 additional domains tied to the service. Its payload collected no host data or telemetry and deleted no files. It had to be modified during testing to evade antivirus products that flagged it for disabling a service.
- After remediation, Eye recorded 2 million update downloads, and requests to the update domain dropped by 98% by March 1.
- Connections appeared to come from installed-and-forgotten instances, with no active use.
- Android users remain exposed because updating requires user interaction and the updater could not be disabled remotely.
- The app also embeds a severely outdated 2014 Chrome engine with no sandbox, which could be exploited.
Remediation
- Uninstall Time4Popcorn from all systems, including Android devices.
- Hunt for the app on corporate, government and military endpoints and for traffic to popcorntimeupd.xyz.