Eye Security - GoKawiil

Eye Security neutralizes RCE flaw in abandoned Time4Popcorn updater

Researchers at Eye Security found that Time4Popcorn, a Popcorn Time fork, used an insecure HTTP updater pointing to an abandoned domain that accepted unsigned executables, letting anyone controlling the domain run code as SYSTEM or root. The firm registered the domain and 14 related ones, observed roughly 3 million Windows and 350,000 macOS connections, and between November 2025 and March 2026 pushed remediation code to disable the vulnerable updater, collecting no host data in the process.

bleepingcomputer.com · 2026-10-23

Security researchers disable abandoned Popcorn Time updater to block botnet risk

Eye Security found that the update mechanism for a Popcorn Time fork called Time4Popcorn was still active on millions of Windows, macOS, and Android devices, communicating with defunct domains over unencrypted HTTP using an outdated, vulnerable version of Chrome. The researchers registered one of the abandoned domains and pushed an update that disabled the service on Windows and macOS, rather than leave the exposed updater running. They said the update process served no real function anymore and only posed a security risk.

theverge.com · 2026-10-23