Abandoned Time4Popcorn updater (CVE-2026-30612) exposed millions of Windows and Mac devices to RCE; Eye Security neutralized it
Researchers at Eye Security disabled an abandoned update mechanism in Time4Popcorn, a fork of the Popcorn Time streaming app, that could have let attackers take over Windows and macOS machines silently. The updater used unencrypted HTTP and accepted executable updates without signature verification, and the associated domains had lapsed and become available for registration. Eye Security estimates 2.5–3 million Windows and 250,000–350,000 Mac devices were affected. The flaw is tracked as CVE-2026-30612.
Entenda a falha
A vulnerabilidade
CVE-2026-30612 is a remote code execution flaw in the updater of Time4Popcorn, an abandoned fork of Popcorn Time that was also distributed under the name "Popcorn Time". The updater fetched updates over unencrypted HTTP and accepted executables without checking digital signatures. An attacker who controls an update domain (the domains lapsed and could be registered) or can tamper with the traffic can deliver their own program. On Windows and macOS this runs silently in the background, even if the app has not been opened in years. On Android the attacker's APK needs user approval. Eye Security estimates 2.5-3 million Windows and 250,000-350,000 Mac devices. There is no fixed version because the software is abandoned.
Como funciona
The installed app leaves a background updater: a service named Update Service on Windows and a launch daemon on macOS. The updater contacts the update domains hard-coded in the software over plain HTTP and asks for an update. Whatever executable comes back is accepted and run, with no check of who sent it. Since the original maintainers left and the domains lapsed, anyone who registered one could answer those requests. On Android the check happens when the app is opened, and the user must approve installing the APK.
Por que é vulnerável
The root cause is missing authenticity and integrity checks on updates: no digital signature verification and no encrypted transport (HTTP instead of HTTPS). The design trusted the update server implicitly. That trust became dangerous when the project was abandoned and its domains became available for others to register. There is no fix from a vendor; mitigation was Eye Security taking over a domain and pushing an update that disables the updater.
Onde está
On Windows, Updater.exe in a Popcorn Time folder under Program Files (or Program Files (x86)), running as the service "Update Service"; on macOS, /Library/PrivilegedHelperTools/PT.updd with the launch daemon /Library/LaunchDaemons/PT.updd.plist.
Como foi descoberta
The articles credit Eye Security with the finding and the response, but do not say how the flaw was first spotted. The researchers registered an abandoned update domain and used the vulnerable mechanism to push an update that disables the updater, without deleting files or collecting host data. By March 2026 the fix had over 2 million downloads and update requests to its domains fell by 98%. Later that month Eye Security transferred the 15 domains it controlled to the Shadowserver Foundation. Eye Security published an advisory with disabling instructions, and Malwarebytes reported it in October 2026.
Explicação gerada por IA a partir da matéria e dos artigos, em 01/11/2026 22:40.
Detalhes técnicos
- The updater fetched updates over HTTP and did not verify digital signatures, so anyone controlling an update domain or able to tamper with traffic could deliver an arbitrary executable (remote code execution).
- Windows and macOS were silently exploitable in the background, even if the app had not been opened in years. On Android, the updater checked at app launch and installing an attacker APK required user approval.
- Eye Security registered an abandoned update domain and pushed an update that disabled the updater: on Windows it stopped and disabled the service, on macOS it prevented the update process from starting. It says it did not delete files or collect host data.
- By March 2026 there were over 2 million downloads of the fix and update requests to its domains fell by 98%. It transferred the 15 domains it controlled to the Shadowserver Foundation.
- The Android updater could not be remotely disabled. The desktop app still has other weaknesses, including an obsolete 2014 Chrome engine and disabled sandbox protections.
- Windows component: Updater.exe in a Popcorn Time folder under Program Files, running as the service "Update Service". macOS: /Library/PrivilegedHelperTools/PT.updd with launch daemon /Library/LaunchDaemons/PT.updd.plist.
Remediação
- Check for Popcorn Time or Time4Popcorn installs and remove them; there is no vendor patch for the abandoned software.
- Verify the background updater is no longer running on Windows and macOS; Eye Security's advisory has disabling instructions.
- On Android, uninstall the app rather than accepting its update prompts.
- Use up-to-date real-time anti-malware protection.
Linha do tempo
-
Abandoned Time4Popcorn updater (CVE-2026-30612) exposed millions of Windows and Mac devices to RCE; Eye Security neutralized it
ler a análise desta fonte ocultar
Researchers at Eye Security disabled an abandoned update mechanism in Time4Popcorn, a fork of the Popcorn Time streaming app, that could have let attackers take over Windows and macOS machines silently. The updater used unencrypted HTTP and accepted executable updates without signature verification, and the associated domains had lapsed and become available for registration. Eye Security estimates 2.5–3 million Windows and 250,000–350,000 Mac devices were affected. The flaw is tracked as CVE-2026-30612.
Technical Details
- The updater fetched updates over HTTP and did not verify digital signatures, so anyone controlling an update domain or able to tamper with traffic could deliver an arbitrary executable (remote code execution).
- Windows and macOS were silently exploitable in the background, even if the app had not been opened in years. On Android, the updater checked at app launch and installing an attacker APK required user approval.
- Eye Security registered an abandoned update domain and pushed an update that disabled the updater: on Windows it stopped and disabled the service, on macOS it prevented the update process from starting. It says it did not delete files or collect host data.
- By March 2026 there were over 2 million downloads of the fix and update requests to its domains fell by 98%. It transferred the 15 domains it controlled to the Shadowserver Foundation.
- The Android updater could not be remotely disabled. The desktop app still has other weaknesses, including an obsolete 2014 Chrome engine and disabled sandbox protections.
- Windows component: Updater.exe in a Popcorn Time folder under Program Files, running as the service "Update Service". macOS: /Library/PrivilegedHelperTools/PT.updd with launch daemon /Library/LaunchDaemons/PT.updd.plist.
Remediation
- Check for Popcorn Time or Time4Popcorn installs and remove them; there is no vendor patch for the abandoned software.
- Verify the background updater is no longer running on Windows and macOS; Eye Security's advisory has disabling instructions.
- On Android, uninstall the app rather than accepting its update prompts.
- Use up-to-date real-time anti-malware protection.