Security researchers have uncovered a serious vulnerability affecting hundreds of thousands of Macs—up to 350,000—left exposed by an abandoned updater tied to a Popcorn Time fork called Time4Popcorn. The outdated component continued running in the background on macOS systems, allowing potential attackers to remotely execute code with full system (root) privileges. The issue, part of what’s been dubbed Operation IXIM, was detailed by research firm Eye Research on October 22, 2026. The vulnerability has been registered under CVE-2026-30612.
What’s the problem?
Time4Popcorn is a branch of Popcorn Time—a BitTorrent streaming app—that continued to circulate long after its original project disbanded in 2014. Although many users stopped using the app, its updater (called PT.updd) resided on macOS systems as a privileged helper process that ran automatically at startup. It connected to its servers using unencrypted HTTP and accepted code without verifying its signature—creating a gaping security hole. If someone controlled the now-abandoned update domains or intercepted the updater’s traffic, they could deliver malicious software that would execute with root-level permissions.
Estimates on how many devices were affected were refined during the investigation. Eye Research initially counted 1.7 million unique Mac identifiers, but adjusted this once realizing several identifiers could be duplicated by changes to a machine’s hostname or network hardware. The final estimate lands between 250,000 and 350,000 Macs. Separately, Windows PCs contacting the same infrastructure numbered between 2.5 million and 3 million—though that doesn’t equate to confirmed unique devices.
How researchers stepped in—and its limits
Seeing no official patches forthcoming, Eye Research took matters into its own hands. The team issued an update of its own that disabled the background service responsible for PT.updd on Macs by using a shell command to stop the launch daemon. They stopped short of removing the entire application, instead leaving other files untouched to minimize disruption.
The work ran into obstacles. Many antivirus tools flagged the repair as malicious because it disabled existing services, so researchers had to tweak their code to avoid triggering those alerts. Through this campaign, which ran from November 2025 into March 2026, they pushed out over 2 million update downloads and reportedly hit more than 1 million systems. By early March 2026, the repair tool was still being downloaded daily—though at a much lower rate (around 5,000/day)—reflecting an estimated 98% drop-off in traffic. Control of 15 affected domains was handed to the nonprofit Shadowserver Foundation to prevent further exploitation.
Risks beyond the updater—and how to clean up
Disabling the updater does not make Time4Popcorn safe. Eye Research found additional hazards: the app itself uses a browser engine from 2014, its sandbox is disabled, and it loads JavaScript over unencrypted connections from defunct developer-controlled domains. While attacks demonstrated on Windows allowed malicious code execution via these methods, similar macOS exploits were not proven.
For those who installed Time4Popcorn, full removal is the safest bet. Simply deleting the app from the Applications folder doesn’t eliminate background updaters. The updater lives in /Library/PrivilegedHelperTools/ under PT.updd, and a launch daemon at /Library/LaunchDaemons/PT.updd.plist keeps it alive. Eye Research published a Terminal command in its advisory that macOS users can run to disable the vulnerable service if still present. Regardless, keeping macOS itself up to date remains critical—built-in protections won’t cover third-party software vulnerabilities.
This issue is specific to the old Time4Popcorn fork, and doesn’t affect a completely separate project that adopted the Popcorn Time name in 2025.
This situation underscores the danger posed by abandoned software, especially apps that run privileged background processes. Even when the main application is forgotten, components like updaters can still expose users to serious risk. Watch for further guidance from cybersecurity firms, and ensure all third-party software is well maintained or removed if left unattended.
