Covered by 2 outlets — first reported by BleepingComputer, Oct 23, 20:55 UTC
Abandoned Popcorn Time app exposed millions of devices to RCE attacks
In brief
Between November 2025 and March 2026, the Dutch security firm Eye Security pushed more than 2 million updates to computers it did not own to switch off a background updater that it said could have allowed an outsider to take over the machine. The updater belongs to Time4Popcorn, an abandoned copy of Popcorn Time, a free app that streamed pirated films and TV over BitTorrent. Popcorn Time was
From The Hacker News's coverage.
Continue reading
2 outlets, in the order they reported it.
BleepingComputerFirst report
Abandoned Popcorn Time app exposed millions of devices to RCE attacks
Researchers remotely disabled a vulnerable updater in the abandoned Time4Popcorn app, a fork of the Popcorn Time BitTorrent client, closing a security flaw that could have allowed attackers to execute malicious code with elevated…
The Hacker News
Researchers Push Over 2 Million Updates to Remotely Disable Popcorn Time Updater That Could Fuel a Botnet
Between November 2025 and March 2026, the Dutch security firm Eye Security pushed more than 2 million updates to computers it did not own to switch off a background updater that it said could have allowed an outsider to take over the…
Explained
The technology and terms in this story. Learn more