Security · Updated 24 Oct, 02:25 am IST
Abandoned Time4Popcorn updater exposed millions to remote code execution
Why it matters for readers: Millions of devices were reachable because an app was abandoned yet still contacting an insecure update server.
- The updater contacted popcorntimeupd.xyz over unencrypted HTTP and accepted executables without verifying digital signatures, creating an RCE risk.1
- Anyone controlling the update domain could execute code as SYSTEM on Windows and as root on macOS (CVE-2026-30612).1
- Eye Security registered the domain, observed up to about 3 million Windows and 350,000 macOS client connections, and remotely disabled the vulnerable updater.1
- Connections originated from residential ISPs as well as corporate, government, and military networks, suggesting widespread, forgotten installations.1
- Time4Popcorn is a fork of the abandoned Popcorn Time BitTorrent client, which previously attracted millions of users and has seen multiple forks.1
Get a brief like this every morning
Uzha reads hundreds of sources and gives you the stories that matter for your work, with every source linked. Free.
Get started