Researchers at Eye Security have taken decisive action to neutralize a significant security risk posed by an outdated Popcorn Time updater. This updater, associated with a fork of the original Popcorn Time BitTorrent client called Time4Popcorn, was still running on millions of devices worldwide despite the software being abandoned since 2014. The vulnerability allowed the updater to run at system startup and execute code provided by its update domain with full system privileges.

The security issue arose because the updater connected to its server using HTTP, a protocol vulnerable to exploitation. With many update domains unclaimed or parked by third parties, malicious actors could have potentially served harmful updates. Eye Security discovered that millions of computers were still reaching out to these domains, with the majority running Windows, followed by macOS and a smaller number on Android.

Eye Security took control of the situation by registering several of these abandoned domains. By March 2026, they had managed to deliver a fix to approximately 2 million systems, effectively disabling the flawed update mechanism on Windows and macOS devices. Unfortunately, the Android version requires user interaction to disable, making it a more complex task.

In collaboration with The Shadowserver Foundation, the domains remain under control, preventing further exploitation. Eye Security advises users to uninstall Popcorn Time entirely as the program is based on an outdated version of Chrome, lacking essential security features like sandboxing. They demonstrated the risk by executing a proof of concept that exploited the vulnerability to run arbitrary code.

The operation highlights the importance of vigilance and proactive measures in cybersecurity, especially for abandoned software that remains in use and poses a threat to users worldwide.