Security researchers discovered a critical vulnerability in the abandoned Time4Popcorn app that could have allowed attackers to execute malicious code on millions of computers. The flaw affected the app’s update mechanism, which transmitted files over unencrypted connections without verifying their authenticity. An attacker controlling the update server could have gained system-level access on Windows machines and root access on macOS devices. Researchers from Eye Security identified approximately 3 million Windows and 350,000 macOS installations connecting to the vulnerable update domain, including systems on corporate, government, and military networks.
Rather than publicly disclosing the vulnerability, Eye Security took direct action by registering the update domain and deploying remediation code that disabled the updater on infected systems. The fix was implemented between November 2025 and March 2026, resulting in approximately 2 million update downloads and a 98 percent reduction in connection attempts by early March. Following the successful operation, domain control was transferred to The Shadowserver Foundation. However, risks remain for Android users and those running the app’s outdated embedded browser, leading researchers to recommend complete removal of the software.
Source: Read the full story at BleepingComputer
This summary was written with AI assistance from the linked source.
Send this to yourself, or to someone who should see it
Enter your email and we will send you a link to this article.
