Abandoned Popcorn Time app exposes millions of devices to RCE attacks
Researchers found a security flaw in an abandoned app that could have allowed attackers to execute malicious code on millions of devices.
Intelligence analysis by Qwen 2.5 (3B)
Researchers discovered a security vulnerability in an abandoned app that could have exposed millions of devices to remote code execution attacks.
Researchers found a security flaw in an app that could have let bad guys run their own code on millions of computers. The app was supposed to update itself, but it was left open to attack because it used an unsecured connection.
Analysis
{"heading_1":"The Vulnerability","paragraph_1":"Researchers at Eye Security discovered a security flaw in the abandoned Popcorn Time app, a fork of the Popcorn Time BitTorrent client.","paragraph_2":"The vulnerability, tracked as CVE-2026-30612, affected Windows and macOS updaters that contacted the app's abandoned domain (popcorntimeupd.xyz) over unencrypted HTTP.","paragraph_3":"The app featured a Netflix-style interface that integrated BitTorrent downloads, allowing users to consume illegal content directly inside the app.","paragraph_4":"The Popcorn Time app was abandoned for legal reasons but later relaunched as a legitimate content-streaming app, leading to the creation of forks such as Time4Popcorn.","paragraph_5":"The vulnerability allowed attackers to execute malicious code with elevated privileges on millions of computers, including Windows and macOS systems.","paragraph_6":"Anyone controlling the update domain could manipulate HTTP traffic and execute code as SYSTEM on Windows and as root on macOS."}
Key points
- The Popcorn Time app was abandoned for legal reasons but later relaunched as a legitimate content-streaming app.
- The vulnerability affected Windows and macOS updaters that contacted the app's abandoned domain over unsecured HTTP.
- The vulnerability allowed attackers to execute malicious code with elevated privileges on millions of computers.
By securing the app and removing the vulnerable updater, the risk of attacks has been significantly reduced.
While the risk has been reduced, the app still uses outdated technology that could be exploited in the future.
