Forgotten Popcorn Time updater exposed up to 350,000 Macs

Eye Research found that the privileged PT.updd helper in the abandoned Time4Popcorn fork launched at macOS startup, fetched code over unencrypted HTTP without signature checks and ran it as root. The CVE-2026-30612 flaw affected an estimated 250,000–350,000 Macs; researchers pushed their own patch disabling the updater and handed 15 domains to the Shadowserver Foundation.

• PT.updd launched at macOS boot and ran downloaded code with root privileges
• Affected Mac estimate cut from 1.7 million to 250,000–350,000 after deduplication
• Eye Research's patch disabled the update service and saw over 2 million downloads
• The main app, built on a 2014 engine with sandbox off, remains unsafe