Researchers at Check Point Security Labs have uncovered a nasty new hacking technique that takes advantage security deficiencies in several popular media players. The exploit uses phony subtitle files to breach a user’s defenses, at which point it’s possible to gain complete control over the system.
Hackers can apparently create malicious subtitle files that run code when they’re loaded into a media player, according to the report published by Check Point. The company estimates that hundreds of millions of users running software like VLC, Kodi, Popcorn Time, and Stremio could be at risk.
Subtitle files are generally perceived as being harmless, and as such they’re rarely vetted too stringently by media players or antivirus software. The situation is made worse by the fact that there’s little standardization, with over 25 different formats with different features and capabilities currently in use.
Check Point has also determined that subtitle repositories are being manipulated to help distribute the malicious files to users. Subtitles submitted by attackers are having are being boosted in the rankings, making it more likely that they’ll be downloaded by users, and selected by media players that can download such files automatically.
Having discovered these vulnerabilities, Check Point disclosed the problem to the developers responsible for the media players that were tested. Some had already taken steps to address the issues, while others are still looking into the situation. As of the time of writing, VLC and Stremio have been officially updated with a fix, while a fixed version of Popcorn Time is available here, and a fixed source code release of Kodi is available here. There are still concerns that other media players might also be affected.
The key here is that subtitle files are being exploited because they’re widely considered to be innocuous. As soon as users and developers drop their guard, malicious hackers see their window of opportunity — and that’s why the work done by organizations like Check Point is so important.
Did you think hitting delete on your AI chatbot conversation actually makes it disappear? Georgia Tech researchers just proved that's not entirely true. They have built a forensic tool called ORISA that can dig deleted conversations from your phone and even rebuild them into a working chatbot session you can keep talking to.
How can ORISA bring deleted AI conversations back?
Touchscreen laptops have been around for years. You can get them in all sizes and shapes. Just not from Apple. For years, the Cupertino giant has treated the idea of a touchscreen MacBook the way I treat a meeting that could have been an email: with open contempt. However, Wednesday looks like the day the company could finally change its mind.
The latest Apple invite puts the “Pro and Tell” showcase in Los Angeles at 10 a.m. PT (1 p.m. ET) on October 28, 2026. Instead of a regular live-streamed keynote, it is an invitation-only, hands-on event for a handful of press and creators (similar to what the company did for the MacBook Neo earlier this year).
Two residents of Chicago have filed a lawsuit in the US over claims that robots run by Coco Robotics and Serve Robotics captured their facial and hand measurements without consent, bringing renewed attention to the food delivery robots. The cases raise a troubling question: If a robot delivers food to your door, can it also be gathering sensitive information about you?
According to a report by The Associated Press, the proposed class-action lawsuits were filed in Cook County on Oct. 9 and allege violations of Illinois’ Biometric Information Privacy Act. The complaints claim that the robots’ cameras and LiDAR sensors captured information on customers’ faces and hands as they approached the machines to pick up their orders. Both have denied the allegations.