Popcorn Time Updater Flaw: How to Check Your Mac or PC

Short answer: If you installed a "Popcorn Time" app years ago, a hidden updater from the Time4Popcorn version may still be running on your computer. It checked old web addresses for updates over plain HTTP and ran whatever it got with full admin rights. Researchers at Eye Security disabled it on more than a million machines, but their advice is simple: uninstall it.

What happened

Time4Popcorn was one of several forks of Popcorn Time, the movie streaming app whose original team shut it down in 2014. Its installer added a small background updater that starts when the computer boots and keeps checking for updates, even if you never open the app again.

The updater had three problems at once:

• It talked to its servers over unencrypted HTTP.
• It did not check code signatures, so it would run any file it was handed.
• It ran that file as root on a Mac, or as SYSTEM on Windows, without asking.

Then the developers walked away and let their update domains expire. Anyone could register one of those domains and push software to every machine still asking for updates. The flaw is tracked as CVE-2026-30612.

How many computers were exposed

Eye Security found the updater during a threat hunt, when a client laptop kept trying to reach an unregistered domain. The company registered it and watched the traffic: about 50 requests a second and more than 3.8 million device IDs in six months.

Those IDs were messy, so the researchers adjusted their numbers:

Platform	Eye Security estimate
Windows	about 2.5 to 3.0 million, likely more
macOS	about 250,000 to 350,000 (first estimate was 1.7 million)
Android	under 5% of traffic, no silent install, so no fix pushed

Eye Security says it found no sign that criminals had used the flaw. The risk was real all the same, since some of the domains were held by third parties or listed for sale.

What the researchers did

With no developer left to fix the software, Eye Security used the updater against itself. After taking legal advice, it pushed a small "update" that turned the updater off. On Macs it unloads the launch daemon so it no longer starts at boot. On Windows it stops and disables the service.

By December 2025 it had reached over a million systems. By March 2026 daily check-ins had fallen by about 98%. Eye Security then handed the 15 domains it controlled to the Shadowserver Foundation, a nonprofit that runs security sinkholes, and published the details in October 2026.

Their fix only switched the updater off. The app itself is still on those machines, along with other old weaknesses, such as a 2014-era browser engine with its sandbox turned off.

Step 1: check a Mac for the updater

Open Terminal and run:

ls -l /Library/PrivilegedHelperTools/PT.updd /Library/LaunchDaemons/PT.updd.plist

If both lines say "No such file or directory", you are clear. If either file shows up, Time4Popcorn was installed at some point.

To see whether it is running right now:

pgrep -l PT.updd

Step 2: disable it on a Mac

This is the same command Eye Security published:

sudo launchctl unload -w /Library/LaunchDaemons/PT.updd.plist

Restart, then run the pgrep command again. It should print nothing.

Step 3: check and disable it on Windows

Look in C:\Program Files\Popcorn Time\ or C:\Program Files (x86)\Popcorn Time\ for Updater.exe. In an administrator Command Prompt, run:

sc.exe stop "Update service"
sc.exe config "Update service" start= disabled

Restart and check Task Manager to confirm Updater.exe is gone.

Step 4: remove the app completely

Disabling the updater is a stopgap. Uninstall Popcorn Time or Time4Popcorn from Settings > Apps on Windows, or drag it from Applications to the Trash on a Mac. On a Mac, delete the two PT.updd files from Step 1 as well. Then run a scan with your security tool.

Common mistakes

• Assuming you are safe because you stopped using the app. The updater runs at boot whether you open the app or not.
• Assuming every Popcorn Time app is affected. The issue is in the Time4Popcorn fork, not the newer project.
• Stopping the updater and leaving the app installed. Eye Security recommends full removal.
• Treating the device counts as exact. They are the researchers' own estimates from messy data.