Millions of dormant devices protected from silent botnet risk
Security researchers neutralized an abandoned software updater that posed a significant threat to working families' digital safety.
By Thabo Mokoena ·
Digital hygiene is a growing concern for households that rely on older software to access media content. On October 23, 2026, security experts confirmed they have neutralized a long-standing vulnerability that could have allowed attackers to control millions of inactive computers.
The software in question is Popcorn Time, a streaming interface for torrents that gained popularity in the 2010s before facing legal pressure from the Motion Picture Association of America. Although the project has seen no development for years, millions of devices still have copies of the software or its fork, Time4Popcorn, installed. Researchers from Eye Security discovered that the updater component for this fork remained active on a vast number of Windows, macOS, and Android systems worldwide.
The primary risk lay in how this updater functioned. It connected to web domains that were no longer maintained, using unencrypted HTTP connections. Furthermore, it relied on an outdated and insecure version of the Chrome browser engine. According to Niels Teusink of Eye Security, this combination created a serious weakness. An attacker could have installed and executed nearly any software with full privileges by taking control of one of the abandoned domains. This could have resulted in a botnet, where compromised devices are used for malicious purposes. Attackers could also have targeted specific machines through man-in-the-middle attacks or monitored which devices were running the software.
To mitigate the risk, the research team registered one of the abandoned domains themselves. They used it to push an update that instructed the updater to disable itself. The team acknowledged ethical questions about this approach but stated that the alternative was to do nothing. They noted that the update process was not performing any useful function and was only adding risk to user systems.
The implementation varied by platform. For Windows users, the update stopped and disabled the service through the Service Control Manager without deleting files or making other changes. On macOS, a shell script executed a command to prevent the update process from starting. The team did not address Android devices because applying the update there would have required direct user action.
The rollout of the fix faced technical hurdles. After the team uploaded the update to VirusTotal, security programs flagged the original version as malware and blocked it. This left the vulnerable updater running on those specific machines. The team had to adjust the update to resolve these false positives.
The exact number of devices at risk remains unclear. Eye Security reported sending out over 2 million update downloads by March, the month they ceased distribution. The company subsequently transferred the domains it had used to the Shadowserver Foundation, a non-profit organization focused on web security. This action ensures the infrastructure remains monitored and secure for the future.
This incident highlights the lingering impact of abandoned software on the digital landscape. For many households, these devices are part of the daily routine for watching movies and shows. The proactive steps taken by researchers demonstrate the importance of maintaining oversight over software that is no longer actively supported.
Source: The Verge
