Old Time4Popcorn App Still Unsafe After Updater Fix
A newly published account explains how researchers disabled an abandoned streaming app's updater. They warn that the old application itself remains unsafe and recommend uninstalling it.
The short version
What you need to know
- The research concerns the old Time4Popcorn fork distributed under the Popcorn Time name—not the newer legal project using that name.
- The intervention ran from November 2025 to March 2026; the October report is not an announcement of a newly fixed vulnerability.
- Disabling the updater did not modernise the app's old browser engine. Eye recommends uninstalling the affected software.
What the new report explains
Eye Research's 22 October account describes Operation IXIM, an intervention to disable a vulnerable update mechanism in the abandoned Time4Popcorn application. The work took place between November 2025 and March 2026. Eye says it published an advisory for CVE-2026-30612 in June; the news here is the detailed account and its reminder that the remaining application is unsafe, not a fresh October patch.
The scope matters because several projects used the Popcorn Time name. Eye identifies the affected software as the old, closed-source Time4Popcorn fork. It explicitly excludes the newer legal alternative that began using the name in 2025. A familiar name or icon alone is therefore not enough to identify the affected installation.
An updater can keep running after you stop watching
According to Eye, the Windows and macOS updaters ran in the background and requested updates over unencrypted HTTP. They accepted executables without a code-signing check, allowing an update to run with SYSTEM privileges on Windows or root privileges on macOS. Control over an update destination or manipulation of the unencrypted traffic could therefore become a route to running code on the device.
Eye says it used that update mechanism to stop and disable the updater. This does not establish that criminals infected every exposed installation, and the report should not be read as a victim count. On Android, the mechanism differed: the application checked when opened and asked the user to install an APK, rather than silently performing the same desktop process.
Why the remaining application still matters
The researchers say the application uses a Chrome engine from 2014 with its sandbox disabled, loads content over HTTP and used JavaScript from abandoned domains. Disabling the updater left the application itself unchanged. Eye's recommendation is to uninstall the affected software, not to treat the intervention as a complete security upgrade.
Check old computers as well as the device you currently use for streaming. Use the operating system's normal installed-app controls to remove an identified Time4Popcorn installation; on a work device, ask IT to identify and remove it. Do not download a supposed replacement or emergency cleaner from an unsolicited message. For technical teams, the research lists file paths and indicators to help identify the affected updater—do not delete every unrelated program simply named Updater.exe.
Where a VPN helps—and where it does not
A properly configured VPN can protect traffic routed through its tunnel from manipulation on the local network. It does not add signature verification to an unsafe updater, repair an obsolete browser engine or make an untrusted update server trustworthy. HTTP traffic can also remain unencrypted after leaving the VPN server.
The practical response is to remove the abandoned application and use maintained, legitimate streaming software. Leaving the old app installed behind a VPN is not an equivalent fix, and a VPN does not change the copyright status of material being accessed.
Primary reading
Sources and further reading
We add plain-English context and practical advice. These links let you inspect the underlying reporting, research and official guidance directly.