GoKawiilSecurity researchers disable abandoned Popcorn Time updater to block botnet risk
Eye Security found that the update mechanism for a Popcorn Time fork called Time4Popcorn was still active on millions of Windows, macOS, and Android devices, communicating with defunct domains over unencrypted HTTP using an outdated, vulnerable version of Chrome. The researchers registered one of the abandoned domains and pushed an update that disabled the service on Windows and macOS, rather than leave the exposed updater running. They said the update process served no real function anymore and only posed a security risk.