Security researchers often find themselves waiting for a vendor to release a patch, but when the vendor is a decade-old abandoned piracy app, waiting is not an option, and that is exactly why the Dutch firm Eye Security took matters into its own hands.

Between November 2025 and March 2026, Eye Security pushed more than 2 million updates to computers it did not own, all to switch off a vulnerable background updater inside Time4Popcorn, an abandoned clone of the popular Popcorn Time streaming app. The firm called this digital rescue mission Operation IXIM.

The Discovery of CVE-2026-30612

The whole operation started during a routine threat hunt. Eye Security noticed a program called Updater.exe on a client's laptop that kept trying to reach a web address that was no longer registered.

Because the updater belonged to Time4Popcorn, and the original Popcorn Time shut down back in 2014, there was no company left to maintain it. The updater ran silently in the background on Windows and Mac from the moment the computer booted up, checking for new versions over an unencrypted connection.

The fatal flaw, tracked as CVE-2026-30612 and rated 9.8 out of 10 by CISA, was that the updater installed whatever it was sent at the highest privilege level, SYSTEM on Windows and root on Mac, without ever checking who sent it.

Because the web addresses it called were abandoned, anyone who registered the right domain could have served their own program to every machine still calling it, opening the door to ransomware, saved password theft, or a massive botnet.

The Scale of the Exposure

To see what would connect, Eye Security registered the abandoned domain itself. The response was staggering, as about 50 requests a second poured in.

Over six months, those requests carried more than 3.8 million different hardware IDs. Because hardware IDs are an unreliable way to count machines (some Windows PCs share them, and some Macs change them), Eye revised its estimate to between 2.5 and 3 million Windows computers and 250,000 to 350,000 Macs.

Mapping a sample of the connecting addresses, Eye saw home users around the world, as well as machines on government, military, and corporate networks.

Turning the Updater Against Itself

With no company left to fix the software and no patch coming, Eye Security decided to use the updater against itself. After taking legal advice, the firm served the machines a custom update that did exactly one thing: it stopped and disabled the updater. It deleted no files and collected no data.

Eye compared the step to Operation Ladybird in 2021, when Dutch police pushed an update to computers infected with the Emotet botnet to disable the malware. The difference here is that Emotet's victims never chose to be infected, while Popcorn Time's users installed the app themselves, though as Eye noted, none of them chose to have a forgotten updater running in the background for years.

The rollout was not without friction. Soon after the updates began, someone uploaded Eye's update to VirusTotal, and antivirus engines started flagging it as malware, which is a fair description of a program that disables a Windows service. Because every product that blocked it left the vulnerable updater running, Eye had to rework the update until only one scanner continued to flag it.

The Handoff to Shadowserver

By December 2025, Eye had updated more than 1 million systems and cut the traffic to its web addresses by about 90 percent. By March 1, it was sending about 5,000 updates a day, a 98 percent reduction.

Judging the remaining numbers too small to interest a botnet operator, Eye stopped, having sent more than 2 million update downloads in all. In late March, Eye handed the 15 web addresses it controlled over to the Shadowserver Foundation, a non-profit that takes abandoned and malicious domains out of circulation, so a trusted party would hold them rather than Eye.

Eye found no sign that anyone else was serving code through the addresses, and the flaw is not listed in CISA's catalog of known exploited vulnerabilities.

What Popcorn Time Users Must Do Now

Switching off the updater does not make the app safe. Eye Security warns that Popcorn Time runs on a 2014 browser engine with its security sandbox turned off, loads content over unencrypted connections, and pulls in code from other abandoned web addresses.

Eye registered those abandoned addresses too, which would have let it run its own code on every machine that opened the app. It did not, but it built a working proof of concept, so the risk is very real. The update only changed the updater, so the rest of the app remains dangerous for anyone who keeps using it.

Eye's advice is to uninstall Popcorn Time completely. If you want to disable the updater by hand before removing the app, here are the commands:

• Windows: sc.exe stop "Update service" and sc.exe config "Update service" start= disabled
• Mac: launchctl unload -w /Library/LaunchDaemons/PT.updd.plist

On Android, the updater is built into the app and cannot be turned off on its own, so removing the app is the only fix.

FAQ

What is Operation IXIM?

It is the name Eye Security gave to its six-month operation where it took over abandoned web domains used by an old Popcorn Time updater, and pushed 2 million custom updates to disable the vulnerable background service.

What is CVE-2026-30612?

It is a critical vulnerability (rated 9.8) in the Time4Popcorn updater. The updater checked for updates over an unencrypted connection and installed whatever it was sent at the SYSTEM or root level without verifying the source.

Did Eye Security steal data or install malware?

No. Eye Security served a single, specific update that only stopped and disabled the updater. It deleted no files, collected no data, and did not touch the rest of the app.

Is Popcorn Time safe to use now?

No. Even with the updater disabled, the app runs on a 2014 browser engine with the security sandbox turned off. Eye Security recommends uninstalling the app entirely.

Why did antivirus software flag Eye Security's update?

Antivirus engines flagged the update as malware because it disabled a Windows service. Eye had to rework the update repeatedly until it no longer triggered false positives on most scanners.

Source: The Hacker News