What’s getting pwned right now

No patch yet3Mitigate nowHighNo patch yetPopcorn Time fork Time4Popcorn: unsigned HTTP updater let anyone push code to millions of devices (CVE-2026-30612)Eye Security found that Time4Popcorn, an abandoned Popcorn Time fork, fetched updates over plain HTTP and ran unsigned executables, so whoever controlled the update endpoint or the network path could run code as SYSTEM on Windows or root on macOS. Researchers saw about 3 million Windows and 350,000 macOS clients checking in and disabled the updater remotely; Android clients stay exposed. There is no fix: uninstall the app.Time4Popcorn (Popcorn Time fork) for Windows, macOS, AndroidSince Oct 23, 2026updated Oct 24, 2026, 14:41 UTCCriticalNo patch yetLinux kernel: unpatched ZDI bug reports with repro details leaked to public LKML (ksmbd RCE, CVSS 9.0)On Oct 21, Trend Micro's Zero Day Initiative sent several unpatched Linux kernel vulnerability reports to security@kernel.org but Cc'd the public linux-kernel and subsystem lists, so full technical details (code paths, KASAN traces) are now public before fixes ship. The worst are two ksmbd (in-kernel SMB server) remote code execution bugs that ZDI scores CVSS 9.0: an SMB Direct integer underflow (needs an RDMA device and a writable share) and a protocol-dispatch race (needs a guest share). Also leaked: an skb_zerocopy local privilege escalation (ZDI-CAN-33367, CVSS 7.8), a vmwgfx out-of-bounds write LPE, and an nvmet info leak. ZDI-CAN-33367 now has a working public exploit: CloudLinux confirmed it gives any local user root on AlmaLinux 8, 9 and 10, Debian 12 and 13, and Ubuntu 24.04 and 26.04 where unprivileged user namespaces are allowed, and setting user.max_user_namespaces to 0 closes that path. No CVEs yet and no fixed mainline or stable release; the skb_zerocopy fix is posted for review but not merged, KernelCare has a livepatch only for CloudLinux/AlmaLinux 10, the ksmbd race fix sits in the ksmbd maintainer tree, and an SMB Direct fix is in a branch aimed at Linux 7.5. No exploitation in the wild reported. Only machines running ksmbd are exposed to the RCEs.Linux kernel: ksmbd (in-kernel SMB server) and SMB Direct, skbuff/NFQUEUE networking, vmwgfx, nvmetSince Oct 21, 2026updated Oct 24, 2026, 02:18 UTCCriticalNo patch yetFearless Wallet browser extension leaked private keys for ~20 monthsThe Polkadot Community Foundation warned that Fearless Wallet browser-extension versions 3.0.1, 3.0.3, 3.0.4 and 3.0.5 contained code, added Feb 19 2025 inside a …