In a coordinated effort spanning November 2025 to March 2026, Dutch cybersecurity firm Eye Security deployed more than two million updates to computers it did not own. The patches disabled a background updater linked to Time4 Popcorn, a defunct fork of the illegal streaming app Popcorn Time, which security analysts warned could have been hijacked to form a botnet.
Eye Security discovered that the Time4 Popcorn updater ran silently on Windows machines, checking for new versions of the pirated streaming client. Because the updater lacked authentication, any remote actor could have injected malicious code, turning infected PCs into a network of compromised hosts. The firm’s engineers reverse‑engineered the updater, created a neutralising patch, and then used a „push‑once” mechanism to silently replace the malicious component on any system that still contacted the original update server.
Eye Security’s legal team argued that the updater posed an imminent threat to public safety, justifying the extraordinary step of updating third‑party devices without consent. The firm leveraged a vulnerability in the updater’s own update protocol, which accepted unsigned binaries from a hard‑coded URL. By mirroring that URL and serving a clean binary, Eye Security forced the updater to replace itself with the safe version.
„We treated the updater as a worm,” said Marieke van Dijk, lead researcher at Eye Security. „If left unchecked, it could have been weaponised by criminal groups to launch DDoS attacks or harvest credentials.” The company logged each patch deployment, confirming that roughly 2.1 million machines received the fix. No evidence suggests the malicious code was ever activated, but the potential for abuse was high.
The operation raises questions about the limits of proactive cyber defence. Critics argue that altering software on devices without explicit permission violates property rights and could open the door to abuse. Supporters counter that the unique nature of the threat—an unmaintained, open‑source updater that could be weaponised—justifies the intrusion.
Legal scholars note that existing statutes, such as the Computer Fraud and Abuse Act, contain ambiguous language regarding „unauthorized” access when the intent is defensive. „This case will likely be cited in future debates about ‘active defence’,” said Professor Lars Meijer of the University of Amsterdam. Eye Security has pledged to disclose its methodology to law‑enforcement agencies and to seek a formal exemption for similar scenarios.
The patching campaign appears to have neutralised the immediate risk. However, the episode underscores the challenges of policing abandoned software that continues to run on millions of devices worldwide. As cyber‑criminals increasingly exploit legacy code, the line between protective action and overreach may blur further.
What exactly was the Time4 Popcorn updater? It was a background service bundled with an unofficial version of Popcorn Time that periodically checked a hard‑coded server for updates, lacking any cryptographic verification.
Why did Eye Security act without owners’ consent? The firm judged the updater to be a high‑risk vector that could be turned into a botnet, and believed immediate remediation outweighed legal concerns about unauthorized access.
Will similar interventions become common? Experts say the practice may grow as more outdated, vulnerable software remains in use, but each case will likely trigger legal and ethical debates about the scope of „active defence.”