Home
Laptops
Laptops News
Popcorn Time Updater Flaw Put Up to 350,000 Macs at Risk, Researchers Warn

Popcorn Time Updater Flaw Put Up to 350,000 Macs at Risk, Researchers Warn

The flaw stemmed from an updater that downloaded files without verifying their digital signatures and used unencrypted connections.

Written by Sucharita Ganguly, Edited by Rohan Pal | Updated: 30 October 2026 11:47 IST

Popcorn Time Updater Flaw Put Up to 350,000 Macs at Risk, Researchers Warn

Photo Credit: Popcorn Time

Users are advised to uninstall Time4Popcorn due to remaining risks

Click Here to Add Gadgets360 As A Trusted Source

Highlights

The flaw affected Windows PCs and hundreds of thousands of Macs
The updater downloaded files without verifying digital signatures
Unencrypted HTTP connections left update traffic vulnerable to tampering

Macs and Windows PCs with an old version of Popcorn Time installed could be at risk, even if their owners no longer use the app. Researchers found that its updater could let attackers run malicious code on affected computers. While they have since taken steps to disable the vulnerable component, that does not make the app itself safe. The incident is a reminder that software can remain a security risk long after its developers have abandoned it.

What Happened?

Cybersecurity firm Eye Research discovered the flaw while investigating an unofficial version of Popcorn Time called Time4Popcorn. The findings, part of its Operation IXIM investigation, were presented at the hack.lu conference in Luxembourg on October 22. The vulnerability, identified as CVE-2026-30612, could allow attackers to run malicious code on affected computers.

The problem is that the app's updater kept running in the background, even on computers where users had stopped using Popcorn Time. By taking control of its update domain or tampering with the network connection, an attacker could potentially send malicious files to these devices. This could put users at risk of password theft and ransomware, although Eye Research found no evidence confirming that attackers had exploited the flaw.

MacBook Pro (2026) With 14-Inch Display Debuts in India: See Price

Why Was the Updater Vulnerable?

The updater had no way of checking whether a downloaded file was genuine before running it. It also relied on unencrypted HTTP connections, which meant attackers could potentially intercept or tamper with data sent between the software and its update server.

The risk was particularly serious because the updater had extensive access to the computer. On Windows, it could run downloaded files with SYSTEM-level privileges. Its macOS counterpart, PT.updd, had root access and could launch automatically when the computer started, potentially leaving the system exposed even when the app was not in use.

The cybersecurity firm estimates that between 250,000 and 350,000 Macs and 2.5 million to 3 million Windows hosts had contacted the update servers. These numbers do not necessarily represent individual computers, however, as flaws in the way the software identified devices meant that some could be counted more than once.

Here’s How the New MacBook Pro’s Illuminated Apple Logo Works

What Did Researchers Do?

Since the original developers were no longer maintaining the app, the cybersecurity firm decided to disable the updater itself. Its fix stopped the update service on Windows and disabled the launch daemon on macOS. The researchers tested the repair before rolling it out, initially restricting downloads to devices they had already identified.

The fix ran into an unexpected problem when antivirus software began flagging it as malicious. Eleven security vendors initially detected the tool, apparently because stopping a system service is also a behaviour associated with malware. Eye Research then modified the executable to avoid those detection signatures and continue the rollout.

By the time the operation ended in March 2026, the firm had distributed more than two million repair downloads. It later handed over the 15 update domains it controlled to the Shadowserver Foundation. However, the download count does not tell us how many individual computers were successfully repaired.

Disabling the updater does not address the vulnerabilities in Time4Popcorn itself, which uses a Chrome engine dating back to 2014, runs without its browser security sandbox and loads content over unencrypted connections. The firm also demonstrated that the app could be used to launch a program on Windows through JavaScript.

The researchers advise users to uninstall the affected version rather than assume that disabling the updater makes it safe. Mac users can check for PT.updd in /Library/PrivilegedHelperTools/ and its associated launch daemon in /Library/LaunchDaemons/PT.updd.plist. Removing the updater's ability to run does not eliminate the risks posed by the app itself.

Comments

Get your daily dose of tech news, reviews, and insights, in under 80 characters on Gadgets 360 Turbo. Connect with fellow tech lovers on our Forum. Follow us on X, Facebook, WhatsApp, Threads and Google News for instant updates. Catch all the action on our YouTube channel.

Further reading: Popcorn Time, Time4Popcorn, Cybersecurity, Security Vulnerability, Malware, Windows, macOS, Mac Security

Sucharita Ganguly

Email Sucharita Ganguly

Sucharita is a writer with Gadgets 360 and is mostly found playing with her cat in her free time. She has previously worked at breaking news desks across organizations. Powered by coffee, The Beatles, Bowie, and her newfound love for BTS, she aims to work towards contributing to a better media environment for women and queer folk. More