Eye Security disables vulnerable Time4Popcorn updater affecting millions of PCs
Researchers remotely disabled the updater in the abandoned Time4Popcorn app, a Popcorn Time fork, closing a flaw that could have let attackers execute code with elevated privileges on millions of computers. Between November 2025 and March 2026 the Dutch firm Eye Security pushed more than 2 million updates to devices it did not own to switch off the background updater that could have been used to take over machines.
Why it matters: Unpatched updaters can become entry points for botnets, posing a large-scale security risk for any organization’s endpoints.
Read the coverage
More in Security
Security15h ago2 sources