Zero Radar
← feed
CriticalSecurity incidentupdated 25 Oct 2026, 13:37 UTC

Abandoned Popcorn Time fork left millions of PCs open to remote takeover

An old, unmaintained streaming app had an updater that could let outsiders run harmful code on your computer. A security firm switched that updater off remotely to close the gap.

2 independent sources
SeverityCriticalSecurity incident
Being exploited?UnclearNo reports either way yet
What to doCheck exposureUninstall Time4Popcorn now, since the app is abandoned and its updater cannot be trusted to stay safe.
How sure is this?2 independent sourcesSeveral independent publishers agree

How the attack works simplified

  1. 1Attacker finds flawTargets the abandoned updater
  2. 2Malicious updateUpdater fetches and runs code
  3. 3Computer compromisedCode runs with elevated privileges
  4. 4Botnet enrollmentMachine can be used remotely
  5. ResultAttacker could control the computer

What happened

The Time4Popcorn updater, a fork of the Popcorn Time BitTorrent client, could be abused to execute malicious code with elevated privileges. Eye Security pushed over 2 million updates between November 2025 and March 2026 to disable the vulnerable updater on machines it did not own.

Why it is dangerous: Attackers could have taken control of affected computers with elevated privileges and potentially enrolled them in a botnet. Anyone who installed Time4Popcorn on Windows is at risk.

Are you affected?

You are affected if you have the abandoned Time4Popcorn app (a Popcorn Time fork) installed with its background updater active.

Time4Popcorn (abandoned Popcorn Time fork) with its updater; specific versions not stated in the material.

What to do

  1. Uninstall Time4Popcorn and any other Popcorn Time forks from your computer
  2. Check for and remove leftover Time4Popcorn updater files or scheduled tasks
  3. Scan the machine with up-to-date antivirus or ask IT to check for unexpected elevated processes

Timeline

  1. 23 Oct 2026, 20:55 UTC
    Publicly disclosed
  2. 23 Oct 2026, 20:55 UTC
    Reported by BleepingComputer · BleepingComputer
  3. 24 Oct 2026, 09:04 UTC
    Reported by The Hacker News · The Hacker News

Sources 2 reports, oldest first

Security press established security newsrooms

Technical details

ID
ZR-94d51fe2 · ZR-201a6bfc
Disclosed
23 Oct 2026, 20:55 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 13:37 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Abandoned Popcorn Time fork left millions of PCs open to remote takeover · Zero Radar