Researchers remotely disabled a vulnerable updater in the abandoned Time4Popcorn app, a fork of the Popcorn Time BitTorrent client, addressing a security flaw that could have allowed attackers to execute malicious code with elevated privileges on millions of computers.
The vulnerability or weakness
The vulnerability, CVE-2026-30612, affected Windows and macOS updaters that contacted the app's abandoned domain over unencrypted HTTP and accepted executables without verifying digital signatures.
| CVE | CVSS | Severity | In CISA KEV | KEV due date |
|---|---|---|---|---|
| CVE-2026-30612 | 9.8 | CRITICAL | No | - |
CVE data: NVD (nvd.nist.gov) and the CISA Known Exploited Vulnerabilities catalog.
Earlier attacks and coverage
No earlier related attack in our archive yet.
Business impact
Organizations could face severe operational disruptions and legal risks if the vulnerability had been exploited, potentially leading to data breaches or system compromises.
Industries affected
The incident primarily affects organizations with users or employees who may have inadvertently installed the app, including residential ISPs, corporations, governments, and military networks.
Users affected
Users of the Time4Popcorn app, even if they were not actively using it, faced the risk of having their devices compromised, as the app could have executed malicious code with elevated privileges.
Build these skills
Sources
- Abandoned Popcorn Time app exposed millions of devices to RCE attacks (BleepingComputer)
