CVE-2026-30612 Time4Popcorn / Popcorn Time updater (Updater.exe 'Update service', macOS PT.updd) still running on millions of machines: how do I find and remove it? There is no patch.

What it is: Time4Popcorn, an abandoned fork of Popcorn Time, installed a background updater that keeps running at boot long after the app stopped being maintained. Eye Security found it still active on millions of machines, including corporate and government networks. The updater fetches updates over an insecure channel and installs them silently with full privileges, so whoever controls (or intercepts) its update traffic could run code on every machine that has it. The Shadowserver Foundation has sinkholed the update domains, but the software is abandoned and will not be fixed, so removal is the only fix. Am I affected: - Windows: Time4Popcorn 6.2.1.18 or earlier. Look for Updater.exe in C:\Program Files (x86)\Popcorn Time\ or C:\Program Files\Popcorn Time\ and a Windows service named 'Update service' that starts at boot. - macOS: 6.2.1.17 or earlier. Look for /Library/PrivilegedHelperTools/PT.updd and /Library/LaunchDaemons/PT.updd.plist. - Android: 3.5.0.173 or earlier (the check runs only when the app is opened). - Fleet-wide: search EDR or software inventory for those paths, the service name and the process names. Fix (remove it): 1. Windows: in an elevated prompt run sc.exe stop "Update service" and sc.exe config "Update service" start= disabled, then uninstall Popcorn Time and delete the Popcorn Time program folder. Confirm the service is gone (sc.exe query "Update service"). 2. macOS: run sudo launchctl unload -w /Library/LaunchDaemons/PT.updd.plist, then delete that plist, /Library/PrivilegedHelperTools/PT.updd and the app. 3. Android: uninstall the app. 4. Block the software by name or hash in application control or EDR so it can't come back. After: since the updater ran with full privileges, check machines that had it for unexpected software, services or launch daemons installed by it. A legitimate app using the Popcorn Time name, released in 2025, is a different product and is not affected by this CVE. Sources: https://labs.eye.security/cve-2026-30612-a-vulnerability-in-time4popcorn-popcorntime/ https://app.opencve.io/cve/CVE-2026-30612 https://pretalx.com/hack-lu-2026/talk/FAGXJE/