A Popcorn Time vulnerability in the abandoned Time4Popcorn fork left millions of computers potentially open to remote code execution. Security researchers intervened by taking control of its expired update domain and disabling vulnerable updaters. The flaw, tracked as CVE-2026-30612, affected the application’s Windows and macOS update mechanisms. Those components downloaded executables over unencrypted HTTP without…