Abandoned Time4Popcorn Updater Enables Code Execution as SYSTEM or Root, CVE-2026-30612

·1 views

A high-severity vulnerability, tracked as CVE-2026-30612, affects the abandoned Time4Popcorn application and its update mechanism. The background updater on Windows and macOS downloads and runs executables over plaintext HTTP without signature verification, so an attacker controlling the update domain or network traffic could run code with SYSTEM or root privileges. Android is a separate pathway that requires user interaction to install the APK. Because no vendor patch exists, researchers recommend completely uninstalling the application and checking for leftover services, launch daemons, and files. Researchers attempted to disable the updater by distributing code through the update channel, though the number of download requests does not indicate the security status of all installed devices. Some update domains have since been transferred to Shadowserver.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

TGLoader 0.3.1 Skips Already-Downloaded Telegram Files on Repeat Runs

The article describes TGLoader, a free desktop app that archives media from Telegram channels to disk using the Telethon library and the user's own API credentials. Version 0.3.1 aims to fetch only new posts on later runs, though the author notes that only the read side of this incremental logic is fully wired, so the stored last-seen message ID is never saved. Duplicate prevention relies mainly on a per-channel metadata file that records completed downloads by Telegram's media ID, with a disk-size check as a fallback. Files are sorted into folders such as Pictures, Videos, Audio, Voice Messages, and Stickers based on the media attributes Telegram provides. The app runs on 64-bit Windows 10 or later and on Apple Silicon Macs.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to add JSON-LD structured data to Astro and Docusaurus sites

Structured data tells search engines what a page represents, such as an article with an author and date, or the organization behind a site, and Google recommends JSON-LD as the format for it. Developers should first check whether their framework already emits types like BreadcrumbList or BlogPosting, to avoid duplicate blocks. Hand-written JSON-LD often breaks on syntax errors, relative URLs, missing @context or @type fields, dates lacking time zones, or markup describing content not visible on the page. The article recommends auditing built HTML for missing blocks, testing templates with Google's Rich Results Test and the Schema Markup Validator, and monitoring Search Console after deployment. For large sites, it suggests an automated build step that generates valid, page-accurate markup.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer builds 59 free browser-based dev tools in vanilla JavaScript

A developer has created Antigravity Tools, a collection of 59 free utilities that run entirely in the browser. The project was built with no dependencies, no server, and no telemetry, so user data never leaves the machine. Tools rely on native browser APIs such as Web Crypto, Canvas, Web Audio, and IndexedDB rather than external libraries. The offerings include JWT decoding, key generation, PII masking, encoding and decoding, AI token cost estimation, JSON and cURL conversion, regex testing, and cron building. The author shares the project and the lessons learned along the way through a DEV Community post.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Gemma 4 pour une API de diagnostic de feuilles de maïs : un atelier pas à pas

Un tutoriel de DEV Community présente la construction en 45 minutes d'une petite API nommée AgriScan, qui reçoit la photo d'une feuille de maïs et renvoie un diagnostic au format JSON. Le projet suit un guide sur le développement assisté par IA, couvrant les fichiers de contexte, le rangement des prompts, la sortie structurée et les tests. La requête passe par FastAPI, puis par le modèle Gemma 4 de Google, appelé via l'API Gemini, avant que la réponse JSON ne soit renvoyée. L'article précise les prérequis : Python 3.11 ou plus récent, Git, une clé d'API Gemini gratuite et quelques photos de test. Le maïs n'est qu'un exemple, les lecteurs étant invités à remplacer ce cas par leur propre problème.

0 comments Read more at DEV Community