Researchers Remotely Disable 2 Million Vulnerable Popcorn Time App Updaters

Security researchers from the Dutch firm Eye Security have taken the unusual step of pushing remote updates to more than 2 million computers to disable a vulnerable background component. The intervention was designed to prevent a legacy software updater from being exploited to create a massive global botnet.

Between November 2025 and March 2026, the researchers targeted a background updater belonging to Time4Popcorn. This software was a popular but eventually abandoned fork of Popcorn Time, a well-known application used for streaming pirated films and television content via BitTorrent.

A Vulnerable Pipeline for Botnets

The researchers identified that the Time4Popcorn updater contained a significant security flaw that could allow an external attacker to take complete control of a host machine. Because the software was no longer maintained by its original developers, millions of installations remained active but unprotected on user devices.

If a malicious actor had seized control of the update mechanism, they could have delivered malware to every active user simultaneously. This would have effectively turned the 2 million affected computers into a coordinated botnet capable of launching large-scale distributed denial-of-service (DDoS) attacks, spreading ransomware, or harvesting sensitive personal data.

Neutralising the Threat

To mitigate the risk, Eye Security researchers used the updater’s own infrastructure to push a final “switch off” command. This update did not remove the primary application but permanently disabled the background updater component, closing the remote entry point that attackers could have exploited.

The operation involved computers that the firm did not own or manage, a move that is relatively rare in the cybersecurity industry due to the complex legal and ethical considerations of interacting with third-party systems. However, the researchers argued that the scale of the potential botnet justified the proactive measure to protect the wider digital ecosystem.

The Risks of Abandoned Software

This incident serves as a significant example of the security risks posed by “abandonware”—software that is no longer updated or supported by its creators but remains installed on millions of devices. Background updaters are particularly dangerous because they often run with high system privileges and regularly check for external instructions.

Users who previously installed piracy-related software like Popcorn Time or its various clones are encouraged to manually audit their systems and remove any legacy applications that are no longer receiving official security patches. While this specific vulnerability has been addressed by the researchers, other abandoned forks may still pose a risk to digital privacy and system security.