Security Firm's Mass Remote Disabling of an Abandoned Popcorn Time Updater Raises Questions About Vigilante Patching

What happened

According to The Hacker News, Dutch security firm Eye Security pushed more than 2 million remote updates between November 2025 and March 2026 to disable a background updater belonging to Time4Popcorn, an abandoned fork of the piracy-streaming app Popcorn Time. Eye Security says the updater could have let an outside party take control of affected machines, and it acted to switch the component off on systems it did not own.

Why it matters for defenders

This case sits outside the usual CVE/vendor-patch lifecycle: an abandoned, unmaintained piece of software with an auto-update mechanism represented a latent takeover vector on a potentially very large population of endpoints (2 million+ updates pushed). Any abandoned app with a live update channel is effectively an unmanaged, unmonitored attack surface — whoever controls or can hijack the update infrastructure controls the install base, with botnet-scale implications if an attacker got there first. It also raises governance questions for defenders: a third party intervened unilaterally on devices it didn't own, which is unusual and worth tracking as a precedent.

What defenders should watch for

• Inventory for legacy/abandoned software with auto-update agents still running, especially consumer-grade or piracy-adjacent tools that may be present on BYOD or unmanaged endpoints.
• Hunt for background updater processes or scheduled tasks tied to Popcorn Time/Time4Popcorn or similar abandoned streaming apps, and review outbound connections to their update infrastructure.
• Treat any software with an update mechanism no longer controlled by an accountable vendor as a standing risk — consider blocking or removing it rather than assuming it's dormant.
• Watch for follow-up reporting on whether the Time4Popcorn update channel was ever actually abused before Eye Security's intervention.

Developing story

Details here are still emerging and come from a single reported source; specifics of the vulnerability, Eye Security's legal basis for pushing updates to devices it doesn't own, and any confirmed exploitation remain unclear. We'll monitor for updates. Original report: The Hacker News.