GoKawiilEye Security neutralizes RCE flaw in abandoned Time4Popcorn updater
Researchers at Eye Security found that Time4Popcorn, a Popcorn Time fork, used an insecure HTTP updater pointing to an abandoned domain that accepted unsigned executables, letting anyone controlling the domain run code as SYSTEM or root. The firm registered the domain and 14 related ones, observed roughly 3 million Windows and 350,000 macOS connections, and between November 2025 and March 2026 pushed remediation code to disable the vulnerable updater, collecting no host data in the process.
GoKawiil's interpretation of the reporting above, not reported fact.
The flaw, tracked as CVE-2026-30612, shows how abandoned software with orphaned infrastructure can remain a live attack surface long after developers move on, since millions of installs apparently sat forgotten on residential, corporate, government and military networks. Eye Security's decision to act unilaterally rather than wait for a vendor fix highlights a recurring dilemma in security research over intervening in systems without owner consent, even when intentions are benign.
- Insecure HTTP updaters without signature verification allowed potential SYSTEM/root code execution on millions of devices.
- Eye Security registered the abandoned update domain and 14 related ones to prevent malicious takeover.
- Between November 2025 and March 2026 the researchers pushed a remediation payload disabling the vulnerable updater without collecting user data.
Malwarebytes Premium Security Software — Given how abandoned apps like Time4Popcorn can expose devices to remote code execution through unverified updaters, having real-time malware and exploit protection is a smart safeguard. Malwarebytes Premium monitors for malicious scripts and unauthorized system changes, helping catch threats that slip past outdated or compromised update mechanisms.
See Malwarebytes Premium Security Software on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-10-23
Published there as: “Abandoned Popcorn Time app exposed millions of device to RCE attacks”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.