Abandoned Popcorn Time app exposed millions of devices to RCE attacks

Researchers remotely disabled a vulnerable updater in the abandoned Time4Popcorn app, a fork of the Popcorn Time BitTorrent client, closing a security flaw that could have allowed attackers to execute malicious code with elevated privileges on millions of computers.

Published 24-Oct-2026 00:33 UTC · First seen 24-Oct-2026 00:32 UTC

Sources

• BleepingComputer · 23-Oct-2026