{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/time4popcorn-windows--6.2.1.18-mac--6.2.1.17-android--3.5.0.173/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-30612"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Time4Popcorn (Windows \u003c= 6.2.1.18, Mac \u003c= 6.2.1.17, Android \u003c= 3.5.0.173)"],"_cs_severities":["critical"],"_cs_tags":["endpoint-security","vulnerability","remote-code-execution","botnet"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe Time4Popcorn application, an abandoned fork of Popcorn Time, contains a critical vulnerability (CVE-2026-30612) in its background updater component. The updater fetches and installs updates over an unencrypted connection without performing any integrity checks or identity verification. An attacker who registers domains formerly used by the application can serve malicious payloads to all connected clients, resulting in full system compromise. The vulnerability affects Windows (up to 6.2.1.18), macOS (up to 6.2.1.17), and Android (up to 3.5.0.173) versions.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows an unauthenticated attacker to achieve remote code execution at the highest privilege level (SYSTEM or root). Potential impacts include ransomware deployment, credential theft, and forced recruitment into botnets. While no active exploitation by malicious actors was confirmed by the researchers as of October 2026, the potential for widespread automated compromise is high.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately uninstall Time4Popcorn from all corporate and personal devices.\u003c/li\u003e\n\u003cli\u003eIf immediate removal is not possible, disable the updater service manually:\u003c/li\u003e\n\u003cli\u003eWindows: Execute \u003ccode\u003esc.exe stop \u0026quot;Update service\u0026quot;\u003c/code\u003e and \u003ccode\u003esc.exe config \u0026quot;Update service\u0026quot; start= disabled\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003emacOS: Execute \u003ccode\u003elaunchctl unload -w /Library/LaunchDaemons/PT.updd.plist\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eUse endpoint detection telemetry to identify the presence of \u003ccode\u003eUpdater.exe\u003c/code\u003e (Windows) or \u003ccode\u003ePT.updd\u003c/code\u003e (macOS) and correlate with network logs.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-24T11:13:30Z","date_published":"2026-10-24T11:13:30Z","id":"https://feed.craftedsignal.io/briefs/2026-10-popcorn-time-updater/","summary":"A critical vulnerability (CVE-2026-30612) in the abandoned Time4Popcorn application allows remote attackers to hijack the unauthenticated background updater to execute arbitrary code with SYSTEM or root privileges.","title":"Time4Popcorn: Insecure automatic updater vulnerability (CVE-2026-30612)","url":"https://feed.craftedsignal.io/briefs/2026-10-popcorn-time-updater/"}],"language":"en","title":"CraftedSignal Threat Feed - Time4Popcorn (Windows \u003c= 6.2.1.18, Mac \u003c= 6.2.1.17, Android \u003c= 3.5.0.173)","version":"https://jsonfeed.org/version/1.1"}