If you installed Popcorn Time on your Mac or PC years ago and forgot about it, now is a good time to delete it. Researchers have found that an abandoned version of the app left a hidden updater running on hundreds of thousands of computers, and anyone who grabbed the right web domain could have used it to take over those machines.
What happened
The problem is in Time4Popcorn, an old, closed-source fork of Popcorn Time. Its developers walked away from the project, but the app’s background updater kept running at startup on every machine where it was installed.
That updater had three serious weaknesses:
- It checked for updates over plain, unencrypted HTTP.
- It installed whatever it received without checking a digital signature.
- It ran with the highest privileges: root on macOS and SYSTEM on Windows.
Worst of all, the update domains it contacted had been left to expire. Whoever registered one of those domains could push any code they wanted to every computer still checking in. The flaw is tracked as CVE-2026-30612 with a severity score of 9.8 out of 10.
How many computers are affected?
- Macs: roughly 250,000 to 350,000
- Windows PCs: about 2.5 to 3 million
Reported affected versions are Windows up to 6.2.1.18, Mac up to 6.2.1.17 and Android up to 3.5.0.173.
Who found it, and what they did
Dutch security firm Eye Security spotted the issue during a routine threat hunt, when a client’s laptop kept trying to reach an unregistered domain. The team registered it and was flooded with around 50 requests per second.
Instead of just watching, the researchers used the same broken updater to send a harmless update that switches the updater off. They say it deletes no files and collects no data. In total, that “kill” update was downloaded more than 2 million times. The Shadowserver Foundation also took control of 15 of the risky domains in March 2026.
Was anyone attacked?
There’s no evidence that criminals used the flaw. Other domains that had already been registered were parked or up for sale. But the risk isn’t fully gone: as of October 26, three of the 20 known domains were still in unknown hands.
What you should do
Uninstall Popcorn Time completely. Disabling the updater alone isn’t enough, because the app itself is outdated, uses an old browser engine with the sandbox turned off, and loads code from abandoned websites. There is no official patch and there won’t be one.
If you want to stop the updater right away before uninstalling:
- Mac (Terminal):
sudo launchctl unload -w /Library/LaunchDaemons/PT.updd.plist - Windows (Command Prompt as admin):
sc.exe stop "Update service"and thensc.exe config "Update service" start= disabled
Several unofficial apps used the Popcorn Time name over the years, so you may not know which one you have. If you have any version installed, remove it to be safe. The newer, legal Popcorn Time project from 2025 is unrelated.
Also read
FAQs
Is Popcorn Time safe to use?
The abandoned Time4Popcorn version is not. Uninstall it.
How do I know if my Mac is affected?
If you ever installed Popcorn Time and the file /Library/LaunchDaemons/PT.updd.plist exists, the updater is on your Mac.
Was the flaw exploited by hackers?
Researchers found no evidence of that so far.
Sources: The Hacker News, MacRumors, CyberInsider.