Security Researchers Disable Vulnerable Popcorn Time Updater on 2M Devices
Dutch firm Eye Security pushed unsolicited updates to disable a risky background updater. The vulnerable component belonged to Time4Popcorn, a defunct torrent streaming app.
TL;DR
- Over 2 million devices received forced updates to disable a vulnerable Popcorn Time updater.
- The updater was part of Time4Popcorn, an abandoned BitTorrent streaming app.
- Exploitation could have led to remote device takeover by attackers.
- Eye Security acted without user consent to prevent potential botnet formation.
- Highlights risks of outdated third-party software in enterprise environments.
In an unprecedented move between November 2025 and March 2026, Dutch cybersecurity firm Eye Security remotely deployed over 2 million updates to devices it did not own. The goal was to disable a background updater component in Time4Popcorn — an abandoned version of the torrent-based media streaming app Popcorn Time — which posed a significant security risk.
The updater vulnerability could have allowed malicious actors to execute arbitrary code and potentially seize control of affected machines. With millions of installations still active, the flaw presented a prime opportunity for large-scale botnet recruitment. By pushing these unsolicited patches, Eye Security effectively neutralized a ticking time bomb in countless unpatched systems.
Background on Time4Popcorn Risk
- Time4Popcorn is an unofficial fork of Popcorn Time that streams pirated content via BitTorrent.
- Its automatic updater ran silently in the background on users' systems.
- The updater lacked proper authentication and secure communication channels.
- This made it possible for attackers to serve malicious updates and gain remote access.
- Because the project was abandoned, no official patches were forthcoming.
Ethical Hacking or Overreach?
- Eye Security acted without explicit permission from device owners.
- Their intervention prevented potential exploitation but bypassed standard consent models.
- The action raises questions about proactive defense versus unauthorized system modification.
- No user data was accessed or collected during the update process.
- Industry experts remain divided on whether such actions should be normalized.
Sources
Sources
Security email updates
One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.