Abandoned Popcorn Time app vulnerability exposed millions to malware risk

How the vulnerability was discovered and mitigated

The vulnerability, tracked as CVE-2026-30612 with a critical severity score of 9.8, was found in the abandoned Popcorn Time app, a tool originally designed to stream pirated content. The flaw allowed anyone controlling the app’s defunct update domain to push executable code to connected systems, potentially delivering malware to millions of devices.

Security firm Eye Security registered the abandoned domain and observed up to 3 million Windows and 350,000 macOS devices still attempting to connect to it. The connections originated from residential ISPs, government and military networks, and corporate environments, highlighting the widespread risk.

Efforts to neutralize the threat

Researchers from Eye Security took action by pushing code that stopped and disabled the app’s updater on most devices. This effort, spanning from November 2025 to March 2026, reduced update requests to the domain by 98%. The remaining 2% of requests come from Android devices, which continue to be vulnerable.

To ensure long-term safety, Eye Security transferred ownership of the domain and 14 others linked to the app to The Shadowserver Foundation, an organization focused on cybersecurity defense.

Why the app posed such a high risk

Popcorn Time was created to simplify streaming of pirated content, mimicking the user experience of legal platforms like Netflix. Legal pressure from the film industry led to its shutdown, but the app remained installed on millions of devices worldwide.

The abandoned software’s update mechanism became a critical weakness. Since the domain responsible for updates was no longer maintained, it could have been acquired by malicious actors to distribute malware. Researchers emphasized that the potential impact of such an attack would have been severe if exploited.

Users are strongly advised to uninstall the app immediately, as it no longer receives security updates and poses a significant cybersecurity risk.

What this means

Lazyfounder analysis — our interpretation, not reported fact.

This incident underscores the risks associated with abandoned software, particularly tools tied to piracy, which often lack security oversight. For founders and operators, it highlights the importance of monitoring third-party dependencies and update mechanisms in their own products. Even defunct apps can leave behind vulnerabilities that expose users—and by extension, their networks—to significant threats. The scale of this issue, spanning corporate, government, and military devices, also serves as a reminder of how widely pirated or unofficial software can proliferate.

Related on Lazyfounder

• More technology news