Eye Security disables dormant Time4Popcorn updater on 2 million devices
Security researchers sent a silent patch to stop an old movie app from checking abandoned web servers, a move that closed a potential backdoor for attackers.
By John Ferrari ·
Popcorn Time, a streaming interface for torrent files, has not received new code in years. Despite its age, the software remains on millions of computers and phones, leaving a quiet gap in digital security.
A team at Eye Security found that the updater for a version of the app called Time4Popcorn was still active. The software ran on Windows, macOS, and Android machines. It contacted web addresses that no one owned and used unencrypted connections. It also relied on an old, insecure version of the Chrome browser engine.
Niels Teusink of Eye Security noted that the flaw gave attackers high-level control. An adversary could have taken over one of the abandoned web domains to push bad software to these devices. This would have allowed them to build a botnet or spy on specific users. The updater had the power to install and run almost any program with full privileges.
The researchers decided to act by registering one of the abandoned domains themselves. They used it to send an update that told the software to turn itself off. The team acknowledged that taking control of the domain raised ethical questions. Teusink said the only other option was to do nothing, adding that the update process was not doing any useful work and only created risk.
The update worked differently on each platform. On Windows, it stopped the service through the system manager without deleting files. On macOS, a script prevented the process from starting. Android devices were skipped because users would still need to install the update manually. The team had to adjust the original update after antivirus tools flagged it as malware. This blockage left some vulnerable machines with the old updater still running.
Eye Security stopped sending updates in March 2026. By that time, they had delivered more than 2 million downloads. The company then handed over the domains it used to the Shadowserver Foundation, a web security nonprofit. The total number of affected devices is not known, but the patch has stopped the silent check for updates on the machines that received it.
