Eye Security made 2M RCEs to disable Popcorn Time's abandoned updater from black hat hackers
The operation ran from November 2025 to March 2026, using the vulnerable updater itself to turn off a risk the abandoned software's makers could no longer patch.
By Ryan Merket · Published
Primary source: labs.eye.security
Why it matters
Eye's response shows how abandoned software can turn a routine update check into privileged code execution years later. It also puts a difficult trade-off in view: the firm used that same mechanism to reduce exposure, while its intervention involved changing software on machines it did not own.
Between November 2025 and March 2026, Eye Research used an abandoned update system in the Time4Popcorn fork of Popcorn Time to deliver more than 2 million downloads that disabled the updater on Windows and macOS systems. The operation turned the same security flaw that could have let an attacker install code into a mechanism for shutting that flaw down.…
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.