An abandoned Popcorn Time updater left up to 350,000 Macs vulnerable to remote takeover, allowing attackers to execute malicious code with full system privileges. Security researchers at Eye Research detailed the discovery in an October 22, 2026 research report about Operation IXIM. The vulnerability affected Time4Popcorn, an abandoned fork of the BitTorrent streaming application that continued circulating under the Popcorn Time name after the original project shut down in 2014.
Some users had stopped using Popcorn Time, but its updater kept running. Eye Research discovered attackers could hijack it to install malware and intervened between November 2025 and March 2026. The investigation began when Eye Research discovered an updater contacting an abandoned domain from a customer's Windows computer. Researchers registered the domain and found approximately 50 requests arriving every second from devices still running the software.
On macOS, the vulnerable component was a privileged helper called PT.updd, which launched automatically when the computer started. The updater contacted its servers over unencrypted HTTP connections and accepted downloaded code without verifying its digital signature. On Macs, that code ran with root privileges, giving an attacker the ability to execute commands with the highest level of system access. The vulnerability was assigned CVE-2026-30612.
Researchers initially recorded approximately 1.7 million unique Mac identifiers, but later revised their estimate to between 250,000 and 350,000 Macs due to hostname and network hardware address changes. Eye Research estimated 2.5 million to 3 million Windows PCs had contacted the affected update infrastructure. With no official patch available, researchers developed a small update that disabled the background service responsible for checking for new updates.
Source: AppleInsider · Summarized by HeadlinesBriefing