Researchers shut down a hidden flaw in the old Time4Popcorn app that could have let attackers take over millions of PCs and Macs. Android users are still exposed.
A forgotten movie-streaming app turned out to be a door left open on millions of computers. Researchers at Eye Security found that Time4Popcorn, a copy of the Popcorn Time app, could be tricked into installing malicious software. They have now switched off its update feature on Windows and Mac. Android phones were not fixed.
Popcorn Time offered a Netflix-style screen on top of BitTorrent downloads, including illegal content. The original project was abandoned for legal reasons. Copies such as Time4Popcorn appeared under the same name and drew millions of users.
Time4Popcorn's updater kept calling home to a web address that nobody owned anymore, popcorntimeupd.xyz. It used an unencrypted connection and accepted files without checking who sent them. Whoever controlled that address could have sent any program, and it would have run with the highest level of control over the computer. The flaw is tracked as CVE-2026-30612.
Eye Security registered the address and watched who connected. They saw up to 3 million Windows and 350,000 Mac connections. These came from home internet providers and from corporate, government and military networks. None of the users seemed to be actively using the app. It had been installed and forgotten.
As the researchers put it, if they could send an update, they could potentially run code on millions of systems, and the impact would be severe in the wrong hands.
Between November 2025 and March 2026, Eye Security used the same weak update path to send a fix that stopped and disabled the updater. They say it collected no data from the computers and deleted no files. They recorded 2 million update downloads. By March 1, requests to the update address had dropped by 98%. Ownership of the address then went to The Shadowserver Foundation, a non-profit security group.
If you never installed Time4Popcorn or any Popcorn Time app, this does not affect you. If you have it on Windows or Mac, the updater has been disabled, so the main risk is closed. That is not the same as safe.
The researchers warn that the app also uses a Chrome engine from 2014 with no sandbox protections, which attackers could exploit. Android is the bigger worry. Installing an update there needs the user to tap, and the researchers could not turn off the Android updater remotely. Their advice is to remove the software entirely.
The steps in the alert box above walk through finding and removing the app. Do it on work machines too, since corporate networks were among those seen connecting.
The material does not say whether anyone else tried to abuse the flaw before the researchers took the address. It also does not say whether the Android updater will be fixed. Until the app is gone from a device, it should be treated as untrustworthy.
If Time4Popcorn or any Popcorn Time app is on a computer or phone, uninstall it now, starting with Android.
Morristown police say scammers posing as bank staff are pushing people to withdraw cash, which is very hard to get back once it is handed over.
Read more: Morristown police warn of scam where fake bank staff ask for cashA viral ChatGPT prompt turns what the chatbot remembers about you into a room image. Posting it publicly could give scammers clues to target you.
Read more: Viral ChatGPT room image could hand scammers clues about youA message saying your Amazon account was hacked is often the scam itself. Checking in the Amazon app first can protect your card, gift balance and phone.
Read more: If Amazon says your account was hacked, check before you call
