Abandoned Time4Popcorn app could have exposed millions of devices

Security researchers found that the abandoned Time4Popcorn torrent app could have let an attacker send malware to millions of devices. The vulnerability, tracked as CVE-2026-30612, has a critical severity score of 9.8/10.

The app’s updater connected to the defunct domain popcorntimeupd.xyz over unencrypted HTTP and accepted executable files without checking their digital signatures. In theory, an attacker who took control of the domain could have used it to send a malicious update to computers where the app remained installed.

Researchers at Eye Security registered the domain and observed up to 3 million Windows and 350,000 macOS client connections. The connections came from residential internet providers, government and military networks, and corporate devices. Eye Security said the devices appeared to have the app installed but not in use.

Instead of sending malware, Eye Security pushed code that stopped and disabled the updater. The change did not remove the app or collect host data or telemetry. From November 2025 to March 2026, the researchers rolled it out to almost all computers; requests to the update domain have since fallen by 98%. The remaining 2% appear to come from Android devices, which may still be at risk. Eye Security transferred the domain and 14 others it acquired to The Shadowserver Foundation and urged users to uninstall the app.