Dutch firm Eye Security says it pushed more than 2 million updates to disable a vulnerable updater bundled with Time4Popcorn, an abandoned copy of the pirated-streaming app Popcorn Time. The company described the operation, named Operation IXIM, in a write-up and a Hack.lu talk on October 22, 2026, as reported by The Hacker News.
The updater is the problem. Updater.exe on Windows and PT.updd on Mac start with the computer, check for updates over an unencrypted connection, and install whatever they receive as SYSTEM or root without verifying the sender. They also called web addresses that had been abandoned. Anyone who registered those domains could push code to every machine still calling them. CISA rates the flaw, CVE-2026-30612, at 9.8 out of 10. It affects Windows builds up to 6.2.1.18, Mac builds up to 6.2.1.17 and Android builds up to 3.5.0.173. As of October 23, 2026 it was not in CISA's Known Exploited Vulnerabilities catalog.
Eye found the issue in November 2025 when Updater.exe on a client laptop kept contacting an unregistered domain. Eye registered the domain and saw about 50 requests per second. Over six months the requests carried more than 3.8 million hardware IDs. Eye's adjusted estimate is 2.5 to 3 million Windows computers and 250,000 to 350,000 Macs. A sample of addresses included home users worldwide plus machines on government, military and corporate networks, though Eye cautioned that conclusions from that sample are hard to draw. Eye disclosed the flaw in June 2026.
With no maintainer and no patch coming, Eye sent its own update that only stopped and disabled the updater. It deleted no files and collected no data. By December 2025 it had reached over 1 million systems and cut traffic to its domains by about 90%. By March 1 it was sending about 5,000 updates a day, a 98% reduction, then stopped. In late March 2026 Eye transferred its 15 domains to the Shadowserver Foundation. Eye said it took legal advice and compared the action to the 2021 Emotet takedown, while noting that Popcorn Time users installed the app themselves. Antivirus engines flagged the update as malware because it disables a Windows service, and some products kept the vulnerable updater running.
Why it matters. This is a clean example of an abandoned-domain update channel acting as an unauthenticated remote code execution path at SYSTEM level. Disabling the updater does not make the app safe. It reportedly runs a 2014 browser engine with its sandbox turned off, loads content over unencrypted connections and pulls code from other abandoned addresses. Eye registered some of those and built a working proof of concept. Domains owned by third parties still reach exposed machines. Eye found no evidence anyone else served code through them. Android users cannot have the updater disabled separately; Eye sent no updates to Android devices.
Mitigation. Uninstall Popcorn Time and Time4Popcorn from managed and personal devices. To disable the updater manually on Windows, run in an elevated prompt: sc.exe stop "Update service" then sc.exe config "Update service" start= disabled. On Mac, run launchctl unload -w /Library/LaunchDaemons/PT.updd.plist. Hunt for Updater.exe or PT.updd on endpoints and for traffic to the domains and file hashes in Eye's write-up. Treat any host where it ran as exposed to SYSTEM or root code execution and review accordingly.
