Researchers say they pushed more than two million updates between November 2025 and March 2026 to disable a background updater in the abandoned Time4Popcorn app, a fork of Popcorn Time. The updater was described as potentially enabling an outsider to take control of affected computers.
Time4Popcorn is linked to the Popcorn Time streaming software that provided a user-friendly interface for downloading copyrighted films and TV via BitTorrent. Outlets describe the risk as enabling remote exploitation, including the possibility of executing malicious code with elevated privileges, and they characterize the broader concern as devices being recruited into large-scale automated attacks if left running.
Coverage emphasizes different aspects: some focus on the technical impact of disabling a remote code execution vulnerability through the updater, while others frame the issue around the threat of turning compromised devices into a “zombie” botnet. Across reports, the central point is that researchers took steps to shut down the updater to reduce exposure for devices where Time4Popcorn was still installed.
