Researchers Quietly Disabled a Dangerous Popcorn Time Updater Running on Millions of Computers

Between November 2025 and March 2026, Dutch security firm Eye Security pushed more than 2 million updates to computers it did not own, in order to switch off a background updater in Time4Popcorn, an abandoned copy of the pirated-film streaming app Popcorn Time. Eye said the updater could have let an outsider take over a machine. The firm found it during a routine threat hunt, when a program called Updater.exe on a client's laptop kept trying to reach a web address that was no longer registered.

Eye registered that address itself and about 50 requests a second poured in. It estimates 2.5 to 3 million Windows computers and 250,000 to 350,000 Macs were affected. The updater ran from startup, checked for new versions over an unencrypted connection, and installed whatever it received at the highest privilege level without checking who sent it. Because the addresses were abandoned, anyone who registered the right one could have sent their own program to every machine still calling it. Eye said an attacker could have installed ransomware, stolen saved passwords or pulled computers into a botnet. It saw home users worldwide, plus machines on government, military and corporate networks, though it said it is hard to draw conclusions from that.

Eye disclosed the flaw in June. It is tracked as CVE-2026-30612 and rated 9.8 out of 10 by the U.S. Cybersecurity and Infrastructure Security Agency. It affects three versions of Time4Popcorn.