Vulnerabilities & Exploits

Time4Popcorn updater put millions at risk of elevated code execution

BleepingComputer reports researchers remotely disabled the abandoned Time4Popcorn updater, a flaw that could have let attackers run code with elevated privileges on millions of Windows and macOS computers. The issue is tracked as CVE-2026-30612.

The update channel itself was the route: researchers could reach it remotely and switch it off, preventing its use to deliver code with elevated privileges. This disabled the mechanism rather than installing a vendor-issued patch, and the report does not establish that installed copies were removed or every device was safe.

For organizations with users still running Time4Popcorn on Windows or macOS, the shutdown closes the reported route but does not settle whether old installations remain or whether any were exposed before it was disabled.

1 source · 4h ago

Timeline

• Oct 23 Reported by BleepingComputer

Sources

• Oct 23 BleepingComputer

  Abandoned Popcorn Time app exposed millions of devices to RCE attacks

  Researchers remotely disabled a vulnerable updater in the abandoned Time4Popcorn app, a fork of the Popcorn Time BitTorrent client, closing a security flaw that could have allowed attackers to execute malicious code with elevated privileges on millions of computers.

  original

Part of the PlainSec briefing for 2026-10-23

Every edition of this story: Time4Popcorn updater put millions at risk of elevated code execution

More from today

• Ruby regex bugs expose applications beyond GitLab
• Arista VeloCloud flaw grants low-privilege users operator access
• Danfoss refrigeration attacks spoiled food across 700 stores