# Forgotten Popcorn Time Updater Exposes 350,000 Macs to Hijacking An abandoned streaming app's unencrypted update mechanism leaves thousands of devices vulnerable to remote code execution. - **Source:** [Cult of Mac](https://brifing.si/source/7e2968d9-bc24-4286-8f9e-146807f06336) - **Published:** 2026-10-30 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/4c3be2a9-3cf5-4073-be5d-0991d6320c2f ## The Hidden Security Threat A long-forgotten updater associated with the Time4Popcorn streaming app has left approximately 350,000 Mac computers exposed to potential hijacking. Although the original project ceased operations years ago, the background process continued running on user devices. This creates a significant security risk for individuals who previously installed the open-source streaming software. ## Vulnerability Mechanism Explained The flaw, tracked as CVE-2026-30612, stems from the application checking for updates over unencrypted HTTP connections. Crucially, the updater failed to verify code signatures, allowing any entity controlling the domain to push malicious code. This process executed with high privileges, granting attackers root access on affected macOS systems without user intervention. ## Discovery During Threat Hunting Dutch security firm Eye Security identified the vulnerability during a routine threat hunt after noticing a client laptop attempting to reach an unregistered domain. The firm published an advisory in June 2025, highlighting how the process automatically initiated at startup. This ensured that even inactive installations remained a persistent security liability. ## Quantifying the Exposed Userbase Initial estimates suggested up to 1.7 million Macs were at risk based on unique device IDs. However, researchers later corrected this figure, noting that hostname-based ID generation inflated the count. The current consensus estimates that between 250,000 and 350,000 Mac devices remain the most accurate calculation of the potentially impacted user population. ## Diverse Network Impact While the majority of connections originated from home internet service providers, Eye Security observed traffic from sensitive environments. The researchers identified requests from corporate, military, and government networks. This broad distribution underscores the danger of legacy software lingering on professional hardware, even when the primary application is no longer in active use. ## Proactive Remediation Strategy Facing an abandoned project with no vendor to issue patches, Eye Security took the unusual step of using the flawed mechanism itself. The firm registered the abandoned domains to deliver a benign update. This update effectively disabled the malicious launch daemon on macOS systems, preventing further unauthorized code execution from the compromised update path. ## Execution of the Fix The remediation rollout commenced in November 2025 and successfully reached over 1 million systems by December. By March 2026, requests to the controlled domains dropped by 98 percent. After sending more than 2 million update downloads, Eye Security transferred the 15 acquired domains to the Shadowserver Foundation to maintain long-term oversight. ## Residual Risks Remain Despite the intervention, some domains associated with the software remain under third-party control. Machines attempting to contact these specific domains may still be exposed to exploitation. Furthermore, disabling the updater does not address the underlying insecurity of the application, which continues to run on an outdated 2014 Chrome engine. ## App Architecture Dangers The application remains inherently dangerous because it lacks modern security sandboxing. It continues to load JavaScript over unencrypted HTTP from abandoned domains, which could facilitate further attacks. Eye Security emphasizes that the software is fundamentally broken and cannot be made secure, regardless of whether the specific updater daemon is currently active. ## Manual Removal Instructions Users who previously installed forks of Popcorn Time are strongly advised to manually uninstall the software. The firm identifies the specific location of the problematic updater as Library/PrivilegedHelperTools/PT.updd. Locating and deleting this file is the only way to ensure the background process is fully removed from the system and no longer active. ## Lessons in Software Lifecycle This incident highlights the critical danger of abandoned software components that maintain persistent background processes. Even when an application is no longer supported, its automated update mechanisms can become powerful vectors for remote code execution. Users must audit their systems for legacy applications to prevent these dormant vulnerabilities from compromising their digital security. ## Sources covering this story - https://www.cultofmac.com/news/forgotten-popcorn-time-updater-macs-exposed — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._