The Popcorn Time updater flaw CVE-2026-30612 let whoever bought its dead domains take over PCs and Macs. How to find it on client machines.
Millions of computers spent months calling web addresses nobody owned, ready to install whatever answered with full administrator rights. The caller was the updater in Time4Popcorn, an abandoned fork of the Popcorn Time movie-streaming app. The people who finally answered were researchers, not criminals.
CVE-2026-30612 is a flaw in the Time4Popcorn updater that lets whoever controls its update domains run any program on the machine, as SYSTEM on Windows or root on macOS (the highest privilege levels each system has). Eye Security's advisory says the updater fetches updates over an insecure channel and installs them in the background without asking the user. Its domains had expired, so whoever registered them could answer, and nothing checked a signature.
CISA scored it 9.8 out of 10 (critical) and classed it as "download of code without integrity check", per the CVE record. It is not on CISA's KEV catalog as of 2026-10-27. The project is abandoned, so no fix is coming.
Updater.exe)PT.updd)Eye Security pushed a "kill" update through the broken updater because criminals could otherwise have registered the same domains first. The hunt started when Updater.exe on a customer's laptop kept calling the unregistered domain popcorntimeupd[.]xyz, per Eye's Operation IXIM write-up. Once Eye registered it, requests arrived at about 50 per second.
From November 2025 to March 2026, Eye's update only stopped and disabled the updater. BleepingComputer reports that it collected no data and deleted no files, and that connections came from corporate, government and military networks as well as homes. Downloads passed 2 million, and by March 1, 2026 requests had fallen 98%. Eye then handed its 15 domains to the Shadowserver Foundation, a non-profit that runs sinkholes (servers that soak up traffic meant for dangerous domains).
Running code on machines you don't own is ethically fraught, and Niels Teusink's Hack.lu talk on October 22, 2026 tackled that head-on. Two gaps remain: Android copies can't be switched off remotely, and The Hacker News says three of the 20 domains have unknown owners; one, time4popcorn[.]info, was registered on October 19, 2026.
Check every client endpoint through your RMM, because these copies are easy to forget: Eye told BleepingComputer that none of the users it saw appeared to be actively using the app. Indicators are from Eye's write-up.
Updater.exe on every drive, with its SHA-256 hash, before anything is removed. On Macs it hashes the two updater files.New-Item -ItemType Directory -Force C:\IR | Out-Null
Get-PSDrive -PSProvider FileSystem | ForEach-Object { Get-ChildItem $_.Root -Recurse -Force -Filter Updater.exe -ErrorAction SilentlyContinue } | Get-FileHash -Algorithm SHA256 | Export-Csv C:\IR\updater-hashes.csv -NoTypeInformation
sudo shasum -a 256 /Library/PrivilegedHelperTools/PT.updd /Library/LaunchDaemons/PT.updd.plist | sudo tee /var/tmp/pt-updd.sha256
Get-CimInstance Win32_Service | Where-Object PathName -like '*Popcorn*' | Select-Object Name, State, StartMode, PathName
Import-Csv C:\IR\updater-hashes.csv | Where-Object Hash -eq '6f895e70e5e560b4b8189a8f7eddf59ea1d237c3d69af7c9e55cfbd76f334827'
sudo launchctl list | grep -i pt.updd
grep -i 4e4ad25e652768157b460a62f87f3d41586a40da4b3b8e40ee35a28d3f5cca03 /var/tmp/pt-updd.sha256
grep -Eio '[a-z0-9.-]*(popcorn|pct-?upd|upd-?pct|t4p-upd)[a-z0-9.-]*\.(info|xyz)' dns-export.log | sort | uniq -c
grep -i 'app_id=T4PSEC' proxy-export.log
Remove the whole app: there is no patch, and Eye warns the app itself runs a 2014-era browser engine with its sandbox disabled.
sc.exe stop "Update service"
sc.exe config "Update service" start= disabled
sudo launchctl unload -w /Library/LaunchDaemons/PT.updd.plist
sudo rm /Library/PrivilegedHelperTools/PT.updd /Library/LaunchDaemons/PT.updd.plist
KinoSec does not scan endpoints, so it won't find Updater.exe on a client laptop; the checks above do that. The confirmed lesson is broader: software and infrastructure nobody remembers owning keep running, and Eye found this one only because a forgotten updater kept calling out. KinoSec's autonomous external network and web app pentests start with reconnaissance from the outside, mapping what each client actually exposes to the internet. They find forgotten services and vulnerable apps, chain them the way an attacker would, and produce findings with remediation you can hand your client.
No. Disabling the updater closes CVE-2026-30612, but Eye Security says the app still uses a 2014-era browser engine with its sandbox disabled and loads content over unencrypted connections. Eye's advice is to uninstall Time4Popcorn entirely.
On Windows, run gcim Win32_Service | ? PathName -like '*Popcorn*' to find the updater service. On Macs, run sudo launchctl list | grep -i pt.updd. Then run the domain search in step 4 of "How do I check if my clients have Popcorn Time installed?" against the client's DNS or proxy logs.
No. Eye Security says the Android updater is built into the app, checks only when the app opens and needs the user to approve an install, so Eye pushed no Android updates. Uninstall the app through your MDM.
CISA's scoring in the CVE record lists a proof of concept, and the flaw is not on CISA's KEV catalog as of 2026-10-27. The Hacker News says three of the 20 updater domains still have unknown owners, so the risk is not over.