Abandoned Popcorn Time app exposed millions of devices to RCE attacks

The abandoned Time4Popcorn app, a fork of the Popcorn Time BitTorrent client, exposed millions of devices to remote code execution (RCE) attacks due to a vulnerable updater that communicated over unencrypted HTTP and executed unsigned updates. The vulnerability, tracked as CVE-2026-30612, allowed full system-level code execution on Windows and macOS if an attacker controlled the update domain. Researchers from Eye Security mitigated the threat by registering the domain popcorntimeupd.xyz and delivering a benign update to disable the updater, preventing further exploitation.

AI-extracted · verify before operational use