Time4Popcorn is an old movie-streaming app. Its updater looked for updates at a web address nobody owned any more and did not check who sent the update. Anyone who took over that address could send code to every computer with the app. A security company found this and switched the updater off. The app is no longer kept up to date, so there is no real fix. The safe move is to remove it.
- Status
- No patch yet
- Being attacked?
- Not known[2]
- Severity
- Critical
- Updated
A security company (Eye Research) used the hole to switch the updater off, from Nov 2025 to Mar 2026. We found no report of criminals using it. Severity: NVD score 9.8 out of 10 (CVE-2026-30612) First reported .
Am I affected?
You are affected if you ever installed Popcorn Time or Time4Popcorn on Windows or Mac. Check Start > Settings > Apps (Windows) or Finder > Applications (Mac).
| App | Device | Affected | Fixed in |
|---|---|---|---|
| Popcorn Time (Time4Popcorn) | Windows | Time4Popcorn for Windows 6.2.1.18 and older | No fixed version exists.[1] |
| Popcorn Time (Time4Popcorn) | Mac | Time4Popcorn for Mac 6.2.1.17 and older | No fixed version exists.[1] |
How to check your version
These checks only look. They do not change anything on your computer.
Popcorn Time (Time4Popcorn) on Windows
Easy way: Start > Settings > Apps > Installed apps. Search for "Popcorn".
Or type this in PowerShellRead-only. It only reads the version and changes nothing.
Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*','HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*','HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*' -ErrorAction SilentlyContinue | Where-Object DisplayName -like '*Popcorn*' | Select-Object DisplayName,DisplayVersion; Get-Process | Where-Object ProcessName -like '*popcorn*' | Select-Object ProcessName,Id
Popcorn Time (Time4Popcorn) on Mac
Easy way: Open Finder > Applications and look for Popcorn Time or Time4Popcorn.
Or type this in TerminalRead-only. It only reads the version and changes nothing.
ls /Applications | grep -i popcorn
How to fix it
- Close the app.
- Windows: Start > Settings > Apps > Installed apps. Find Popcorn Time or Time4Popcorn, click the three dots, then Uninstall.
- Mac: open Finder > Applications, drag the app to the Trash, then empty the Trash.
- Run a scan with your antivirus after you remove it.
- Change important passwords if you are worried. Do this from another, clean device.
More on each app: Is my Popcorn Time up to date?
Official links
Check before installing, and only use these official links or the app's own update button.
For AI agents
This page as data: /incidents/popcorn-time-time4popcorn-dead-updater.json. All problems: /feed.json. Use read-only checks only, and ask before installing anything.
Tracking numbers (CVE): CVE-2026-30612
Sources
- NVDNVD: CVE-2026-30612 (Time4Popcorn) (Aug 27, 2026)
- ResearcherEye Research: Operation IXIM, preventing a botnet of millions of Popcorn Time users (Oct 22, 2026)
"Maker", "CISA", "NVD", "GitHub advisory" and "Official notice" are official sources. "Researcher" and "News" are extra context.