Up to 350,000 Macs exposed by a forgotten Popcorn Time updater
An abandoned Popcorn Time updater left up to 350,000 Macs vulnerable to remote takeover, giving potential attackers a way to execute malicious code with full system privileges. Popcorn Time Security researchers at Eye Research detailed the discovery in an October 22, 2026, research report about Operation IXIM. The vulnerability affected Time4Popcorn, an abandoned fork of the popular BitTorrent…
Up to 350,000 Mac computers may have been exposed to security risks due to an abandoned Popcorn Time updater, according to a report by Eye Research. The vulnerability stemmed from Time4Popcorn, an abandoned version of the popular BitTorrent streaming application that continued to circulate under the Popcorn Time name even after the original project shut down in 2014.
The updater became problematic as it ran automatically upon system startup, posing a risk of malicious code execution with full system privileges. Eye Research detected the issue between November 2025 and March 2026, when a high volume of requests were observed from devices still using the software. The updater communicated with its servers via unencrypted HTTP connections and executed downloaded code without verifying its digital signature, allowing attackers to take control of the system.
The vulnerability, assigned CVE-2026-30612, was exploited through abandoned update domains, potentially affecting 250,000 to 350,000 Macs. Eye Research developed a fix that disabled the background service, but legal and ethical concerns arose due to the lack of explicit user consent. Despite the intervention, the outdated application itself could still expose users to various security threats, highlighting the ongoing risks associated with abandoned software.
Written by urgent.news from AppleInsider's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
