A Dutch security firm, Eye Security, says it remotely pushed more than 2 million updates between November 2025 and March 2026 to disable a background updater used by Time4Popcorn, an abandoned Popcorn Time clone. According to the company, the updater created a serious risk because an outsider could potentially have used it to take control of affected machines.

While the software involved is linked to a consumer piracy application rather than mainstream business tools, the incident is still relevant for European companies. It shows how abandoned software, legacy update mechanisms and unmanaged endpoints can leave systems exposed long after a product is no longer actively used or supported.

What happened

According to reporting by The Hacker News, Eye Security identified a risk in the updater component used by Time4Popcorn, a discontinued fork of Popcorn Time. The firm said the background updater could have been abused to deliver code to machines running the software, creating a possible path to full device compromise.

Eye Security then said it pushed updates to disable the updater on systems it did not own, affecting more than 2 million computers over several months. Based on the source, this was presented as a defensive action intended to prevent the updater from being hijacked and potentially used as botnet infrastructure or as a broader remote access channel.

The available source describes the security firm's account of events. It does not independently verify the full scope of exposure on every affected machine.

Why it matters for European businesses

The main business lesson is not about Popcorn Time itself. It is about software lifecycle risk. Many organisations still have unmanaged applications, old utilities, test tools or unauthorised software sitting on employee devices. If those applications include weak or abandoned update mechanisms, they can become an easy route for malware delivery, ransomware deployment or botnet recruitment.

For European businesses, this matters in several ways:

• Shadow IT risk: Employees may install unofficial or unapproved software on work devices, especially on remote or lightly managed endpoints.
• Legacy software exposure: Unsupported applications often retain privileged background services, scheduled tasks or auto-update components long after business use has ended.
• Supply-chain style attack paths: If an attacker can abuse an update channel, they may not need phishing or credential theft to gain access.
• Operational and compliance consequences: A compromised endpoint can lead to data loss, service disruption and potential regulatory issues if personal or business data is affected.

The case also underlines a governance issue for IT teams: simply uninstalling visible software is not always enough if helper services or updater processes remain active in the background.

Who may be affected

The immediate incident appears most relevant to systems where Time4Popcorn had previously been installed. But the broader risk applies much more widely.

• SMEs with limited endpoint management may be more exposed to abandoned or unapproved software remaining on staff devices.
• Remote-first organisations may have less visibility into what is installed on laptops outside the office network.
• IT teams managing mixed Windows fleets should pay particular attention to background services, auto-updaters and unsigned or outdated applications.
• Regulated businesses face additional risk if unmanaged software creates a path to data exposure or service interruption.

What companies should consider

• Audit installed software: Review endpoints for unsupported, unapproved or rarely used applications, especially those with background update services.
• Check for orphaned updaters: Identify scheduled tasks, services and startup items that remain after software is no longer used.
• Strengthen application control: Use allow-listing, software inventory tools or endpoint management policies to reduce shadow IT.
• Monitor outbound update traffic: Unexpected connections to old update domains or repositories can indicate unmanaged software still running.
• Improve endpoint detection: EDR and vulnerability management tools can help surface risky legacy components before they are exploited.
• Review offboarding processes for software: Decommissioning should include removal of helper processes, credentials, scheduled tasks and update agents.

For business leaders, the incident is a reminder that cyber risk does not only come from new threats. Old software left behind in the environment can create a practical attack path years later. Even when the affected application is not a business tool, the underlying lesson is highly relevant for organisations managing laptops, remote devices and mixed software estates.