Millions of computers were left exposed to remote code execution because an abandoned streaming app’s background updater kept running years after users stopped using it.
In research published Oct. 22, Dutch cybersecurity firm Eye Security detailed its intervention against the vulnerable updater in Time4Popcorn, an abandoned fork distributed under the Popcorn Time name. The research does not apply to the separate legal project that began using that name in 2025.
In its report, the firm says the service’s updater, present on millions of devices, kept making requests to infrastructure that was no longer properly maintained. Its updater relied on unencrypted traffic and did not verify the authenticity of downloaded executable files, creating a potential route for attackers to deliver malicious code through what users might have assumed was routine software maintenance.
The vulnerability, identified as CVE-2026-30612, has a reported CVSS score of 9.8 out of 10, according to The Hacker News.
Eye Security used the update mechanism to disable the updater on responding Windows and macOS computers, reducing exposure without eliminating the risk across all installations. Android users should uninstall the app because its updater is embedded in the application and cannot be disabled separately.
What really happened
Time4Popcorn, an abandoned torrent app once used to stream pirated movies and TV shows, had been discontinued years earlier. However, its background updater was still trying to contact its former update domain. Even though the domain had expired, computers with the updater installed continued sending periodic requests to it.
Eye Security stumbled upon the activity during a routine threat hunt after noticing that a client's laptop repeatedly tried to reach an unregistered domain. When the researchers registered the domain to investigate, they saw roughly 50 requests per second.
To understand the scale of the exposure, the firm monitored the incoming requests over six months, collecting more than 3.8 million distinct hardware identifiers. However, these identifiers did not reliably represent individual computers.
The cybersecurity firm revised its estimate to 2.5 million to 3 million Windows computers and 250,000 to 350,000 Macs potentially affected by the vulnerable updater.
The issue wasn’t limited to device scale and request volume. It also included the kinds of devices trying to reach the service. According to the researchers, connections came from residential, corporate, government, and military networks, although their presence alone does not confirm those organizations had been compromised.
The danger lay in what the updater could do, not simply in the volume of requests. It communicated over unencrypted traffic and accepted downloaded executable files without verifying their authenticity, while running with SYSTEM privileges on Windows and root privileges on macOS.
If a malicious actor controlled the update domain, they could have supplied any payload of their choice; with the extensive system privileges, the payload could deploy ransomware, steal credentials, or execute code remotely, depending on how it was configured.
Disabling the updater did not eliminate every risk
Between November 2025 and March 2026, Eye Security used the vulnerable update mechanism to deliver code that stopped and disabled the updater on Windows and macOS. The operation generated more than two million update downloads, with daily update traffic falling by approximately 98%.
In late March, the company transferred its 15 domains to the Shadowserver Foundation for sinkholing. Other domains remained under third-party ownership, and Eye did not deploy updates to Android devices.
Even on Windows and macOS, turning off the updater did not fix other weaknesses in Time4Popcorn. The operation therefore addressed a major route to compromise without making the abandoned application safe.
What security teams should check beyond the app
The immediate recommendation is to remove the affected Time4Popcorn software. Eye Security’s advisory provides instructions for disabling the desktop updater, but recommends removing the application completely. Disabling one component does not resolve the abandoned app’s other weaknesses.
For administrators, that means checking more than whether employees still use the app. Review software inventories and endpoint telemetry for installations, then check for the Windows updater service or macOS helper identified in the advisory. On Android, remove the application rather than attempting to disable a separate updater.
After removal, verify that the associated background components no longer run or restart when the device boots. Review available DNS, proxy, and endpoint records for unexpected update downloads or executable launches. Finding the application or associated network traffic should trigger a check of whether the vulnerable updater remains active; those findings alone do not establish that a device was compromised.
The wider lesson is to include unused applications, browser extensions, and background utilities in routine software reviews. Check whether they still receive security support, what privileges they retain, and whether their update mechanisms remain trustworthy.
Updating supported software remains essential, but abandoned applications require a retirement decision. Security teams should document their removal and verify the result, rather than treating a lack of user activity as evidence that the software no longer presents a risk.
Read more: Forgotten infrastructure can also expose people through ordinary browsing, as researchers found when expired website domains became a route for delivering iPhone spyware.