Between November 2025 and March 2026, Dutch security firm Eye Security pushed more than two million non-destructive updates to machines running an abandoned Popcorn Time fork in a bid to disable a background updater that could have let an outsider take over those computers. The updater — found as Updater.exe on Windows and PT.updd on macOS — routinely checked long-abandoned web addresses and installed whatever it was served with SYSTEM or root privileges, making it a high-risk vector for ransomware, credential theft, or botnet recruitment.
What Eye Security found
Eye Security discovered the updater during a routine threat hunt after a client’s laptop repeatedly tried to contact an unregistered domain. When the firm registered the address to observe traffic, roughly 50 requests per second started arriving. Over six months, the incoming requests contained more than 3.8 million distinct hardware IDs; because the IDs were inconsistent across platforms, Eye revised its estimate to about 2.5–3 million Windows machines and 250,000–350,000 Macs calling the updater. Mapping showed connections from home users and devices on government, military, and corporate networks, though Eye cautioned against drawing firm conclusions from that sampling.
How the updater worked
The updater ran at system startup on both Windows and macOS, checked for new versions over unencrypted HTTP, and installed updates at the highest privilege level without validating the source. Because the domains it contacted had been abandoned, anyone who controlled them could have served arbitrary code to all machines still reaching those addresses. Eye disclosed the flaw as CVE-2026-30612 in June; the U.S. Cybersecurity and Infrastructure Security Agency (CISA) assigned it a 9.8 severity rating.
The emergency fix: Operation IXIM
With no vendor left to patch the abandoned Time4Popcorn software, Eye Security, after taking legal advice, registered several of the abandoned updater domains and served a single-purpose update that stopped and disabled the updater without deleting files or collecting data. The operation—named Operation IXIM in Eye’s write-up and their Hack.lu talk—resembled past takedowns that pushed disabling updates to infected systems. After initial pushback from antivirus engines (which flagged the disabling update as malware), Eye reworked the payload until only one scanner continued to detect it. By December 2025, Eye had applied updates to more than one million systems and reduced traffic to the controlled domains by about 90 percent; by March 1, 2026, daily update deliveries had fallen to roughly 5,000, a 98 percent reduction. In total, Eye delivered more than two million update downloads before stopping. On March 20, 2026, Eye transferred the 15 web addresses it controlled to the Shadowserver Foundation so a trusted sinkhole operator would hold them.
Aftermath and remaining risks
Eye found no evidence that other parties were actively serving updates through the domains it registered, though many domains the updater called were never under Eye’s control and remain with outside owners—machines that contact those addresses are still exposed. The vulnerable Popcorn Time builds also use an outdated 2014 browser engine with sandboxing disabled, fetch content over unencrypted connections, and reference other abandoned addresses; Eye demonstrated a proof of concept showing how dangerous that combination could be. The flaw was not listed in CISA’s catalog of known exploited vulnerabilities as of October 23, 2026.
What users and defenders should do
Eye’s primary recommendation is to uninstall Popcorn Time. Disabling the updater is not sufficient to make the app safe because the rest of the application remains insecure. For those who prefer to disable the updater manually, Eye published the commands users can run:
Windows:
sc.exe stop "Update service"
Windows:
sc.exe config "Update service" start= disabled
Mac:
launchctl unload -w /Library/LaunchDaemons/PT.updd.plistOn Android, the updater is built into the app and installs only if the user accepts; Eye did not push updates to Android devices, and removing the app is the only fix there. Defenders can also search networks for the Updater.exe and PT.updd files and monitor traffic to the domains Eye listed in its write-up (which includes 20 domains and associated file hashes).
Eye’s intervention was surgical and limited in scope: the update disabled the dangerous automatic updater but left the rest of the unmaintained application in place. For anyone still running Time4Popcorn or other abandoned Popcorn Time forks, the safest course remains complete removal.
Licensed under CC BY-ND 4.0 International