They Pushed 2 Million Updates to Machines They Didn't Own — Here's Why

Michael Miller · 2026-10-24

Picture this: a security team quietly reaching into over 2 million computers that don't belong to them. Not to steal anything, not to spy. Just to switch something off before someone else found it first. That's the strange story behind Time4Popcorn, an abandoned copy of Popcorn Time — the free app that once let people stream pirated movies and TV shows over BitTorrent. And it raises a question every privacy-minded user should be thinking about: who's really in control of the software running on your machine? ### What Actually Happened Between November 2025 and March 2026, the Dutch security firm Eye Security pushed more than 2 million updates to computers it did not own. The target was a background updater bundled with Time4Popcorn. On the surface, an updater sounds harmless. It's the little helper that checks for new versions and installs them automatically. But here's the catch — an updater that nobody maintains is basically an unlocked back door. If an outsider could hijack that update channel, they could push whatever code they wanted onto every machine still running the app. That's the recipe for a botnet: a sprawling network of infected computers controlled by a single actor. ### Why an Abandoned App Is a Real Risk Popcorn Time was, for a while, a cultural phenomenon. It made pirated content feel as easy as Netflix. But the project was never exactly stable — it splintered into forks, copies, and clones, and Time4Popcorn was one of the leftovers. When a project gets abandoned, the people who ran it walk away. The servers go quiet. The updates stop. But the software? It's still out there, humming along on millions of machines, waiting for someone to notice the gap. > "An updater is only as safe as the people still watching it. When they leave, the door stays open." That's the uncomfortable truth here. The updater wasn't malicious. It was just neglected — and neglect, at scale, becomes a vulnerability. ### The Fix That Feels a Little Uncomfortable Eye Security's move was unusual. Pushing updates to devices you don't own is normally the kind of thing that makes people nervous — and honestly, it should. But in this case, the alternative was worse: leave the updater running and hope no one with bad intentions found it first. So what can you take away from all this? - **Check what's still running in the background.** Old apps you forgot about are often the weakest link. - **Be wary of abandoned software.** If a project hasn't shipped an update in years, treat it like a house with the windows left open. - **Auto-updaters are powerful.** They're convenient, but they're also a trusted channel — and trusted channels get hijacked. - **Isolate what you don't trust.** If you need to run risky or outdated software, keep it away from anything sensitive. ### The Bigger Picture This story isn't really about piracy or even about Popcorn Time. It's about what happens when software outlives the people who built it. Millions of machines can keep running long after the lights go out in the room where the code was written. For anyone who cares about privacy and control — and that includes people who rely on antidetect browsers to keep their online identities separated — the lesson is the same. The tools you install have lives of their own. Know what they're doing, and know who's still watching them. Because sometimes the scariest thing on your computer isn't a virus. It's something everyone forgot was still there.