- Eye Research found that the updater in the Time4Popcorn fork of Popcorn Time (CVE-2026-30612) would run any program it was sent, with high privileges on Windows and macOS.
- The software is abandoned, so no vendor can patch it. Eye Research counted 3.8 million hardware IDs, but says that figure is unreliable. Its own estimate is 2.5-3.0 million hosts.
- Ask your security team which forgotten software still checks for updates, and over which connection, in the telemetry you already collect.
Some risk sits in software someone chose and then forgot. A threat hunt by Eye Research, a managed security provider, shows how far that can go. An updater left running on old laptops would have run a stranger's code. And no vendor was left to fix it.
What Eye Research found
Eye Research's analysts noticed a process called Updater.exe on a client laptop. It was trying to reach a domain that was no longer registered, popcorntimeupd.xyz. The file belonged to Time4Popcorn, a closed-source fork of Popcorn Time, a BitTorrent video client. The original Popcorn Time was shut down in 2014. Eye Research says a newer, legal project has used the name since early 2025. This research does not apply to that project.
Eye Research says none of its clients were actively using the software. Only a handful had it installed, and the updater kept checking in anyway. The team registered the domain to see who came knocking. About 50 requests per second arrived. Over six months it saw more than 3.8 million hardware IDs. Roughly half ran Windows, about 45% macOS and under 5% Android. The researchers later found that counting by these IDs was unreliable, as the last section explains.
How the flaw works
The updater asked the server whether an update was available, over plain HTTP, which is unencrypted. The server's reply was a JSON message. If that message contained a link to a program, the updater downloaded it and ran it. On Windows it ran as NT AUTHORITY\SYSTEM, the highest level. On macOS it ran as root. Eye Research says there was no code signing, so nothing checked who made the file.
Both versions ran in the background from startup. Android differed. The app checks for updates only when opened, and then asks the user whether to install an APK. The flaw is tracked as CVE-2026-30612.
Each platform used its own update domains. Whoever controlled a domain could push code to the Windows or macOS clients that used it. On Android, the user would still have to approve the install. Third parties held the remaining domains Eye Research found, and some were listed at prices in the thousands of dollars. Many of the Android and macOS domains were still unregistered.
Buying them all would not have fully solved the problem. Anyone able to tamper with a user's network traffic, such as on an open Wi-Fi network, could still alter an unencrypted update.
No vendor, no patch
The usual process is to tell the vendor, wait for a patch and hope people install it. Here the researchers say the vendor was effectively absent. The distribution site had been inactive for years and the update domains were out of its hands.
Eye Research mapped a sample of the connecting IP addresses, and they spanned the globe. Most came from home internet providers. Some came from corporate, government and military networks. The researchers draw no firm conclusions from this. They do judge that many of those systems would appeal to criminals.
So Eye Research chose to act. Between November 2025 and March 2026 it served its own update that switched the updater off. Its legal team advised first. The researchers cite Operation Ladybird, where Dutch police neutralised Emotet infections. They note a difference: Popcorn Time users presumably installed the software on purpose. But no user chose to keep a forgotten updater running for years.
The update did very little by design. On Windows it stops and disables the update service. On macOS it unloads the launch daemon. Eye Research says it collected no telemetry and deleted no files. It tested at small scale first. Early on it served only hardware IDs it had already seen, once each, and redirected clients to HTTPS where possible. After a few weeks it relaxed those limits to reach more systems.
Hardware IDs were a poor way to count machines
Eye Research's testing exposed a second bug. Windows devices kept asking for the update repeatedly, from different IP addresses. The cause was a reversed error check in the code that builds each machine's ID. The machine's unique identifier was left out of the calculation. The ID then rested on disk details alone.
That matters because PCs cloned from one image share those details. Eye Research saw one volume GUID on hundreds of HP EliteBook and ProBook G9 laptops across many customers. Many Windows machines therefore shared one ID, so the raw count undercounts Windows.
The researchers say the same raw count overstates macOS. So the 3.8 million IDs mix two errors that pull in different directions. Eye Research's own estimate, after learning this, is lower: about 2.5-3.0 million hosts.
What leaders should ask
This shows that a vendor's silence does not end a product's risk. An update channel with no signature check is a standing offer to whoever controls the address. The lesson is not about piracy. It applies to any abandoned tool that still phones home.
Ask your security team three questions. Which installed programs still check for updates, and over plain HTTP? Does your endpoint telemetry list software nobody has opened in years? Who may remove it without waiting for an owner who no longer exists?
Eye Research argues that with no vendor and no patch coming, nobody else would have acted. Few organisations can count on that kind of rescue. Most must find their own forgotten updaters first.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: labs.eye.security.
