Popcorn Time fork Time4Popcorn: unsigned HTTP updater let anyone push code to millions of devices (CVE-2026-30612) ยท updates https://pwn.watch/i/popcorn-time-time4popcorn-updater-cve-2026-30612 Eye Security found that Time4Popcorn, an abandoned Popcorn Time fork, fetched updates over plain HTTP and ran unsigned executables, so whoever controlled the update endpoint or the network path could run code as SYSTEM on Windows or root on macOS. Researchers saw about 3 million Windows and 350,000 macOS clients checking in and disabled the updater remotely; Android clients stay exposed. There is no fix: uninstall the app. en Fri, 23 Oct 2026 00:00:00 GMT Popcorn Time fork Time4Popcorn: unsigned HTTP updater let anyone push code to millions of devices (CVE-2026-30612): Eye Security discloses CVE-2026-30612; the desktop updater was disabled remotely, Android remains exposed, and users are told to uninstall. https://pwn.watch/i/popcorn-time-time4popcorn-updater-cve-2026-30612 https://pwn.watch/i/popcorn-time-time4popcorn-updater-cve-2026-30612#2026-10-23-d649d6a3 Fri, 23 Oct 2026 00:00:00 GMT high <p><a href="https://research.eye.security/cve-2026-30612-a-vulnerability-in-time4popcorn-popcorntime/">Source</a></p> Popcorn Time fork Time4Popcorn: unsigned HTTP updater let anyone push code to millions of devices (CVE-2026-30612): Eye Security details Operation IXIM: from Nov 2025 to Mar 2026 it pushed an update that only stops and disables the updater to over 2 million downloads (98% fewer update requests by March), then handed its 15 update domains to The Shadowserver Foundation. Some update domains are still held by third parties, and the app itself (a 2014 Chrome engine with the sandbox off, loading JavaScript over HTTP) remains unsafe, so uninstall it. https://pwn.watch/i/popcorn-time-time4popcorn-updater-cve-2026-30612 https://pwn.watch/i/popcorn-time-time4popcorn-updater-cve-2026-30612#2026-10-22-2b97d738 Thu, 22 Oct 2026 00:00:00 GMT high <p><a href="https://labs.eye.security/operation-ixim-preventing-a-botnet-of-millions-of-popcorn-time-users/">Source</a></p>