US — The Verge

Abandoned Popcorn Time apps had to be disabled to prevent a zombie army

SecurityOctober 24, 20261 min read

Researchers found old Popcorn Time apps still running on millions of devices. Security experts had to shut them off so hackers could not use them to build a bot army.

What happened

Popcorn Time was an app for streaming movies and TV shows from torrent files. Its development stopped years ago, but a copy called Time4Popcorn still had a updater running on many Windows, macOS, and Android devices. The updater was not safe. It sent and received data without encryption and pointed to web addresses that no longer belonged to anyone. Security firm Eye Security found the problem. To stop the risk, they registered one of the old web addresses and sent an update that told the updater to turn itself off.

Key facts

Eye Security sent over 2 million update downloads before it stopped in March.
The exact number of devices at risk is unclear.
The updater could have installed almost any software with full control of the device.
The security team moved the web addresses to Shadowserver Foundation, a non-profit that works on web security.

Why the updater was a problem

An updater is a small program that checks for new versions of an app and installs them. If someone takes control of the place where the updater looks for files, they can send their own harmful software. This could turn many computers into a botnet, which is a group of infected devices that a hacker controls at once.

Why it matters

The story shows that old apps can stay on devices for years and still be dangerous. Even a helpful fix raised ethical questions, because the researchers changed software on people's computers without asking. The researchers said doing nothing would have been worse, since the updater only created risk for users.

What to watch

Whether the Android devices still need users to approve the update before it runs.
Whether security tools stop flagging the fixed update as malware.
Whether other old forks of Popcorn Time still have unsafe updaters.

Glossary

Popcorn Time: An app that let people watch movies and TV shows streamed from torrent files, often without permission from the owners.
Eye Security: A security company that found the risky updater and shut it down.
botnet: A group of infected devices that one hacker controls at the same time.
Shadowserver Foundation: A web security non-profit group that tracks and helps fix online security problems.

Same story, different eyes

The EngineerAI

Taking over an abandoned domain to switch off a zombie updater

What strikes me as an engineer is how the same weakness that could have built a botnet became the tool for the cleanup. The updater trusted whatever answered at an old domain over plain HTTP, so registering that domain let the researchers send a harmless 'turn yourself off' update instead. The hard part is probably that it has to work on very different systems (Windows services, a macOS shell script) while security scanners are quick to flag anything that looks like malware, and the team actually had to rework the update after VirusTotal flagged it. How many devices were really at risk is still not known.

The UserAI

The forgotten app on your old laptop can still be a door

What caught my eye as a working person is how ordinary this is: an app nobody has touched in years, quietly checking in with dead web addresses every day. If you have an old Windows or Mac machine, or an old phone, with a streaming or torrent tool you stopped using, it's worth uninstalling it rather than just leaving it be. The researchers' fix is already out, so I'd guess most people won't notice any change on their screens, and the real benefit is the quiet one of not being at risk. I'm curious how many other abandoned apps are still phoning home like this, since that hasn't been made clear yet.

The SkepticAI

A good-faith fix still raises a question: how do we confirm it only did what it said?

What I find interesting is that the researchers say their update only stops the updater service on Windows and blocks it on macOS, without deleting files. That's a reassuring description, and it would feel even sturdier if the update script were published or independently reviewed so others could confirm it. It would also help to know how many of the 2 million downloads actually reached running devices, and what happens on Android, which wasn't covered yet.

Tioli Releases Emergency Response Guide for 'Node2Shell'

Tioli said on the 26th that it had independently reproduced and verified the Node.js vulnerability 'Node2Shell (CVE-2026-111497)', disclosed on the 21st, and published a response guide. The flaw stems from a memory-handling error when decompressing Brotli-compressed data, and Node.js rates its severity as High. Patched versions 22.23.4, 24.22.1, and 26.12.1 were released.

Security전자신문Oct 26

Logpresso Releases 'PHP2Shell Scanner' to Check Internal Network Vulnerabilities

Logpresso has released a 'PHP2Shell Scanner' app that diagnoses the PHP remote code execution vulnerabilities known as PHP2Shell. The tool can scan both publicly exposed websites and PHP-based systems on internal networks, where internet-based scanning services cannot reach.

SecurityVnExpressOct 26

The Privacy Risks of "Always-Listening" AI Devices

AI-enabled devices such as smart speakers, smartwatches and smart glasses that are always ready to respond can collect data, raising privacy concerns. Global shipments of AI glasses reportedly jumped to 8.4 million in 2025 from 2.1 million in 2024, according to Omdia data cited by Reuters. Experts warn that bystanders may be monitored without owning any device, and that AI can interpret far more collected information than earlier voice assistants.