Abandoned Popcorn Time Fork Updater Exposed 3 Million Systems to Unsigned Remote Code Execution

The updater, built on a 2014 Chrome base without code signing or HTTPS, ran at boot and fetched executables from domains that had lapsed or been parked. Eye Security observed connections from end-user ISPs plus government, military, and corporate networks before sinkholing 15 domains starting November 2025. By March 2026 roughly 2 million Windows and macOS systems received the fix, cutting requests 98 percent. Android clients required manual intervention because the updater was embedded in the app.

CVE-2026-30612 records the lack of signature verification and transport security. Shadowserver Foundation assumed control of the domains in late March 2026, also sinkholing additional abandoned domains that still served JavaScript. The original project ended in 2014; Time4Popcorn continued distribution without maintenance, leaving the mechanism intact. No vendor existed to issue patches, forcing third-party remediation.

Legacy BitTorrent clients persist because uninstall routines are absent and users treat them as set-and-forget media tools. The same pattern appears in other abandoned forks where update infrastructure outlives the maintainers. Connections from sensitive networks indicate how procurement and patching gaps allow decade-old binaries to remain active inside protected perimeters.

Manual removal is required; the application retains an unsandboxed 2014 Chrome engine vulnerable to JavaScript execution. Continued monitoring of the sinkholed domains will show whether residual clients migrate to new infrastructure or finally drop offline.