Researchers disable vulnerable updater in abandoned Popcorn Time fork, closing RCE risk on millions of devices
Eye Security registered expired domains, remotely patched systems after finding unencrypted update channel allowed arbitrary code execution at root level
Security researchers have remotely disabled a critical vulnerability in the abandoned Time4Popcorn application, a fork of the Popcorn Time BitTorrent client, that could have allowed attackers to execute malicious code with elevated privileges on millions of computers. The flaw, tracked as CVE-2026-30612, stemmed from unencrypted HTTP connections to an expired domain and a total lack of digital signature verification on updates.