Abandoned Popcorn Time app exposed millions of devices to RCE attacks

Security firm Eye Security has quietly shut down a dangerous update mechanism in Time4Popcorn, an unmaintained fork of the Popcorn Time BitTorrent streaming client, before it could be hijacked by attackers. The flaw, tracked as CVE-2026-30612, stemmed from Windows and macOS clients fetching updates over plain HTTP from the long-abandoned domain popcorntimeupd.xyz without checking digital signatures, letting whoever controlled that domain push arbitrary code with SYSTEM or root privileges. After registering the dead domain themselves, the researchers found millions of still-connected but inactive installs across home, corporate, government and military networks, and between November 2025 and March 2026 they pushed a harmless fix that disabled the vulnerable updater, cutting traffic to the domain by 98 percent before handing it over to the Shadowserver Foundation. Android installs remain at risk since remote remediation wasn't possible there, and the app's outdated, sandbox-less Chrome engine from 2014 still poses a danger, so users are urged to simply uninstall the software.