Popcorn Time Updater Flaw Put Up to 350,000 Macs at Risk, Researchers Warn

Macs and Windows PCs with an old version of Popcorn Time installed could be at risk, even if their owners no longer use the app. Researchers found that its updater could let attackers run malicious code on affected computers. While they have since taken steps to disable the vulnerable component, that does not make the app itself safe. The incident is a reminder that software can remain a security risk long after its developers have abandoned it.

What Happened?

Cybersecurity firm Eye Research discovered the flaw while investigating an unofficial version of Popcorn Time called Time4Popcorn. The findings, part of its Operation IXIM investigation, were presented at the hack.lu conference in Luxembourg on October 22. The vulnerability, identified as CVE-2026-30612, could allow attackers to run malicious code on affected computers.

The problem is that the app's updater kept running in the background, even on computers where users had stopped using Popcorn Time. By taking control of its update domain or tampering with the network connection, an attacker could potentially send malicious files to these devices. This could put users at risk of password theft and ransomware, although Eye Research found no evidence confirming that attackers had exploited the flaw.

Why Was the Updater Vulnerable?

The updater had no way of checking whether a downloaded file was genuine before running it. It also relied on unencrypted HTTP connections, which meant attackers could potentially intercept or tamper with data sent between the software and its update server.

The risk was particularly serious because the updater had extensive access to the computer. On Windows, it could run downloaded files with SYSTEM-level privileges. Its macOS counterpart, PT.updd, had root access and could launch automatically when the computer started, potentially leaving the system exposed even when the app was not in use.

The cybersecurity firm estimates that between 250,000 and 350,000 Macs and 2.5 million to 3 million Windows hosts had contacted the update servers. These numbers do not necessarily represent individual computers, however, as flaws in the way the software identified devices meant that some could be counted more than once.

What Did Researchers Do?

Since the original developers were no longer maintaining the app, the cybersecurity firm decided to disable the updater itself. Its fix stopped the update service on Windows and disabled the launch daemon on macOS. The researchers tested the repair before rolling it out, initially restricting downloads to devices they had already identified.

The fix ran into an unexpected problem when antivirus software began flagging it as malicious. Eleven security vendors initially detected the tool, apparently because stopping a system service is also a behaviour associated with malware. Eye Research then modified the executable to avoid those detection signatures and continue the rollout.

By the time the operation ended in March 2026, the firm had distributed more than two million repair downloads. It later handed over the 15 update domains it controlled to the Shadowserver Foundation. However, the download count does not tell us how many individual computers were successfully repaired.

Disabling the updater does not address the vulnerabilities in Time4Popcorn itself, which uses a Chrome engine dating back to 2014, runs without its browser security sandbox and loads content over unencrypted connections. The firm also demonstrated that the app could be used to launch a program on Windows through JavaScript.

The researchers advise users to uninstall the affected version rather than assume that disabling the updater makes it safe. Mac users can check for PT.updd in /Library/PrivilegedHelperTools/ and its associated launch daemon in /Library/LaunchDaemons/PT.updd.plist. Removing the updater's ability to run does not eliminate the risks posed by the app itself.