Abandoned Popcorn Time app exposed millions of devices to remote code execution attacks

Researchers identified a vulnerability in the Windows and macOS updaters of the Time4Popcorn app that could have allowed attackers to execute malicious code with elevated privileges. The vulnerability is tracked as CVE-2026-30612. Eye Security used the update mechanism to deliver remediation code that stopped and disabled the updater.