2 Million Secret Updates Killed a Hidden Threat on Millions of PCs

Emily Davis · 2026-10-24

Between November 2025 and March 2026, something unusual happened in the world of cybersecurity. A Dutch security firm called Eye Security pushed more than 2 million updates to computers it didn't own. Their goal? To remotely disable a background updater that could have let an outsider take over those machines. That updater belonged to Time4Popcorn, an abandoned copy of Popcorn Time—a free app once used to stream pirated films and TV over BitTorrent. Now, you might be wondering: why would a security company go around updating software on strangers' computers? The answer lies in the risks posed by abandoned software and how it can be exploited. ### What Was the Risk? The Time4Popcorn updater was a ticking time bomb. Because the app was no longer maintained, its update mechanism could be hijacked by attackers. If someone gained control of the update server, they could push malicious code to millions of devices, essentially turning them into a botnet. Eye Security saw this and decided to act—by taking over the update process themselves and disabling it. - **The threat:** An abandoned updater that could be used to distribute malware. - **The action:** Eye Security pushed 2 million updates to disable it. - **The outcome:** Millions of devices are now safer from potential botnet recruitment. ### Why This Matters to You Even if you never used Popcorn Time, this story highlights a broader issue: abandoned software is a security risk. When developers stop maintaining an app, they leave behind a backdoor that criminals can exploit. Eye Security's intervention is a rare example of proactive protection, but it's not a permanent fix. ### How to Protect Yourself So, what can you do to avoid becoming part of a botnet? Here are a few practical steps: - **Audit your installed apps:** Remove any software you no longer use, especially if it's no longer updated. - **Keep everything updated:** Enable automatic updates for your operating system and trusted applications. - **Use antidetect browsers wisely:** Tools like antidetect browsers can help protect your privacy, but they're not a substitute for good security hygiene. - **Stay informed:** Follow security news to learn about emerging threats. ### The Bigger Picture Eye Security's mass update was a bold move, but it raises questions about consent and control. What if a security firm decides to modify your software without your knowledge? While their intentions were good, it's a reminder that we need better ways to handle abandoned software. Perhaps app stores should automatically flag abandoned apps, or developers should be required to provide a kill switch when they discontinue a product. For now, the 2 million updates have neutralized a real threat. But as the digital world evolves, we'll need more sustainable solutions to keep us safe.