Vulnerabilities · 3h ago

Time4Popcorn updater put millions at risk of elevated code execution

BleepingComputer reports researchers remotely disabled the abandoned Time4Popcorn updater, a flaw that could have let attackers run code with elevated privileges on millions of Windows and macOS computers. The issue is tracked as CVE-2026-30612.

The update channel itself was the route: researchers could reach it remotely and switch it off, preventing its use to deliver code with elevated privileges. This disabled the mechanism rather than installing a vendor-issued patch, and the report does not establish that installed copies were removed or every device was safe.

For organizations with users still running Time4Popcorn on Windows or macOS, the shutdown closes the reported route but does not settle whether old installations remain or whether any were exposed before it was disabled.

Timeline

• Oct 23 Reported by BleepingComputer

Sources

1 source covering this story

• BleepingComputer Oct 23

  Abandoned Popcorn Time app exposed millions of devices to RCE attacks

  Researchers remotely disabled a vulnerable updater in the abandoned Time4Popcorn app, a fork of the Popcorn Time BitTorrent client, closing a security flaw that could have allowed attackers to execute malicious code with elevated privileges on millions of computers.

Entities

• CVE-2026-30612

Part of the PlainSec briefing for 2026-10-23

Editions

• Briefing for 2026-10-23

Related stories

• Ruby regex bugs expose applications beyond GitLab
• Arista VeloCloud flaw grants low-privilege users operator access
• Zimbra PoCs can miss command injection in Swatchdog