Millions of computers around the world spent years calling home to a domain that nobody owned. The machines ran Time4Popcorn, an old fork of the Popcorn Time streaming app, and most of the people who installed it had long since forgotten it was there. A Time4Popcorn vulnerability in the update system left all of them open to full takeover. Researchers reached the domain first.
How the Time4Popcorn vulnerability worked
The Time4Popcorn vulnerability carries the tag CVE-2026-30612, and it lived in the Windows and macOS updaters. Those updaters called out to popcorntimeupd.xyz over plain HTTP, which meant nothing encrypted the traffic and nothing proved the server answering was the real one. Worse, the app ran whatever file came back without ever checking its signature. Two mistakes had to line up for this to work, and they did.
Access rights are what turn a sloppy bug into a serious one. On Windows the updater ran as SYSTEM, and on macOS it ran as root, so any code sent down that channel took full control of the machine. An attacker could have installed spyware, dropped ransomware or folded millions of devices into a botnet. The user did not have to click, download or fall for anything.
Millions of forgotten installs, still phoning home
Researchers at Eye Security registered the lapsed domain and then just watched the traffic arrive. Up to 3 million Windows clients and another 350,000 macOS clients checked in for updates, which puts the scale of the Time4Popcorn vulnerability far past a niche piracy problem. Plenty of that traffic came from normal home broadband lines. But corporate networks, government systems and military networks turned up in the data too.
The software sat installed and forgotten long after its owners stopped using it, yet it kept reaching out to a domain that anyone could have bought for twenty dollars. None of the users behind that traffic seemed to be watching anything. A dead app still runs, keeps its network access and still obeys its update server. Eye Security went on to register 14 more domains tied to the service, so the Time4Popcorn vulnerability could not return through a second expired address.
Researchers closed the flaw by using it
Between November 2025 and March 2026, Eye Security pushed fix code down the same broken channel. The payload stopped the updater and shut it off for good. It took no data, logged no telemetry and deleted nothing else on the machine, a careful set of limits that kept the whole job on the right side of the law.
The team had to tweak the code mid-testing, because antivirus tools kept flagging it. Shutting down a running service looks like malware even when the intent is clean, so they adjusted the payload until it stopped tripping alarms. After that, the fix went out to every client that called in.
Results came back fast, and they show how well the fix for the Time4Popcorn vulnerability worked. Eye Security logged roughly 2 million downloads of its fix. By 1 March this year, requests to the domain had fallen by 98%. The company then handed the domain over to The Shadowserver Foundation, a non-profit that keeps it parked and harmless.
Android users are still exposed
Desktop users got the cleanup, but it never reached every platform where the app still runs. Android updates need a tap from the user, so nobody could push a silent fix to a phone. That leaves the vulnerability in Time4Popcorn live on every mobile install. Deleting the app is the only safe move there.
There is a second problem that no update could ever have solved. Time4Popcorn ships with a Chrome engine from 2014 and runs it without a sandbox, so more than a decade of public browser exploits sit inside the app waiting for someone to reach them. Anyone who gets that far has plenty to choose from. So the Time4Popcorn vulnerability was never the only thing wrong here.
What a VPN can and cannot do here
Plenty of people who ran apps like this one also ran a VPN and assumed the tunnel covered them. A VPN does help with one part of this attack, because it stops your internet provider, or anyone sharing your local network, from tampering with plain HTTP traffic in transit. On hostile public Wi-Fi that protection is real and worth having.
Encryption guards data while it moves, and it makes no judgment about what is moving or where it came from. If the update server itself hands over a malicious file, the VPN carries that file to you safely and quickly. A VPN could never have blocked the Time4Popcorn vulnerability on its own. Signed updates and the habit of deleting dead apps cover the ground that no privacy tool can.
Final Thoughts
This one ended well, which is rare enough to be worth saying out loud. A security firm found a loaded gun pointed at millions of machines, took the bullets out, and then handed the weapon to a non-profit rather than keeping it. Had a criminal crew registered popcorntimeupd.xyz first, the story would read very differently.
The wider lesson travels far beyond one abandoned piracy app. Every unused program on your system keeps its rights, its update logic and its power to run code, long after you stop thinking about it. Check what you have installed, and strip out what you no longer use. The Time4Popcorn vulnerability sat behind that kind of forgotten door for years, and nobody noticed.
