Time4Popcorn: Insecure automatic updater vulnerability (CVE-2026-30612)

The Time4Popcorn application, an abandoned fork of Popcorn Time, contains a critical vulnerability (CVE-2026-30612) in its background updater component. The updater fetches and installs updates over an unencrypted connection without performing any integrity checks or identity verification. An attacker who registers domains formerly used by the application can serve malicious payloads to all connected clients, resulting in full system compromise. The vulnerability affects Windows (up to 6.2.1.18), macOS (up to 6.2.1.17), and Android (up to 3.5.0.173) versions.

Impact

The vulnerability allows an unauthenticated attacker to achieve remote code execution at the highest privilege level (SYSTEM or root). Potential impacts include ransomware deployment, credential theft, and forced recruitment into botnets. While no active exploitation by malicious actors was confirmed by the researchers as of October 2026, the potential for widespread automated compromise is high.

Recommendation

• Immediately uninstall Time4Popcorn from all corporate and personal devices.
• If immediate removal is not possible, disable the updater service manually:
• Windows: Execute sc.exe stop "Update service" and sc.exe config "Update service" start= disabled.
• macOS: Execute launchctl unload -w /Library/LaunchDaemons/PT.updd.plist.
• Use endpoint detection telemetry to identify the presence of Updater.exe (Windows) or PT.updd (macOS) and correlate with network logs.