How a benign payload stopped a risky updater
Eye Security registered the domain popcorntimeupd.xyz and, between November 2025 and March 2026, used it to push a clean remediation binary to the Time4Popcorn Windows and macOS updaters.
The updaters spoke to the domain over plain HTTP and never checked a code signature. That design flaw is catalogued as CVE‑2026‑30612 and would let anyone who controls the server execute code as SYSTEM on Windows or as root on macOS.
Instead of exploiting the flaw, the researchers delivered a payload that did nothing on the host: it collected no data, touched no files and was tweaked just enough to slip past most antivirus engines.
During the campaign the domain saw roughly 3 million Windows and 350 thousand macOS client connections. After the remediation payload was live, more than 2 million download requests were logged, and by 1 March 2026 the total traffic to the update server had collapsed by 98 %.
Who is still at risk
Anyone who still runs the Time4Popcorn updater on Windows or macOS is now protected, provided they received the remediation binary. Android users are left exposed because the mobile updater requires manual interaction and cannot be disabled remotely.
The application itself bundles a Chrome engine from 2014 that lacks modern sandboxing, a fact that would have made exploitation easier if a malicious update ever landed.
What you can do right now
Uninstall Time4Popcorn if you don’t need it. If you keep it, block popcorntimeupd.xyz at the firewall or hosts file level. Verify that any future updates come over HTTPS and are signed.
Keep your OS and browsers up to date; the older Chrome engine is a known weak spot. Consider using reputable streaming services that follow proper update hygiene.