Researchers Force Updates on 2+ Million Computers to Disable Popcorn Time Fork Updater

According to reports, the Dutch security firm Eye Security initiated a large-scale update push between November 2025 and March 2026, delivering over 2 million updates to computers it did not own. The target was the Time4Popcorn application, a fork of the discontinued Popcorn Time software that streams pirated content via BitTorrent. Eye Security stated that the application's background updater contained a vulnerability that could allow an outsider to take over the affected machine.

The updater in question was designed to check for and install updates for Time4Popcorn. Researchers warned that this mechanism could be abused to execute arbitrary code with the privileges of the user running the application. Because Time4Popcorn is no longer actively developed or supported, the vulnerability posed a persistent risk on systems that still had the application installed.

In response, Eye Security pushed updates specifically crafted to disable the vulnerable updater component. The updates effectively disabled the background process, removing the alleged remote code execution vector. The firm stated that the action was taken to protect users, even though the systems targeted were not owned or managed by Eye Security.

The operation has sparked debate in the cybersecurity community. While the intent was to mitigate a security threat, the method of pushing updates to computers without explicit user consent or ownership is unusual and its legality is unclear. Time4Popcorn itself is an abandoned project associated with streaming pirated content, which adds further complexity to the situation.

As of now, no official patch has been released by the original Time4Popcorn developers, as the project has been abandoned. The forced updates from Eye Security serve as the de facto mitigation for the identified risk.