Dutch Firm Deploys Millions of Unauthorised Patches to Shut Down Vulnerable Popcorn Time Updater

Between November 2025 and March 2026 a Dutch cybersecurity company, Eye Security, rolled out more than two million software updates to computers it did not own, aiming to disable a background updater linked to the Time4Popcorn streaming client.

The updater in question, embedded in the popular but unofficial Popcorn Time application, had been flagged by researchers as a potential gateway for remote code execution. Security analysts warned that the component could be hijacked to install malicious code, turning affected machines into nodes of a larger botnet.

Eye Security’s intervention was carried out silently, without prior notice to the device owners. The firm said its goal was to neutralise a “critical vulnerability” that could allow an attacker to take full control of a system. By issuing a forced shutdown of the updater, the company intended to protect users from a threat that it believed could be exploited on a massive scale.

The operation has sparked debate over the legality and ethics of unilateral remote patches. While many in the security community applaud the proactive stance against a known risk, consumer‑rights advocates caution that modifying software on devices without consent may breach privacy laws and could set a precedent for overreach.

Time4Popcorn, the developer behind the updater, has not publicly responded to the incident. The application itself has long existed in a legal gray area, offering users access to copyrighted media without official licensing. Its unofficial status means it rarely receives the same level of scrutiny or support as mainstream streaming services, leaving its users more exposed to security flaws.

Industry observers note that the Eye Security episode underscores a broader challenge: balancing rapid threat mitigation with respect for user autonomy. As cyber threats become more sophisticated, some security firms argue that swift, decisive action— even without explicit permission— may be necessary to prevent widespread damage.

Legal experts suggest that authorities in the Netherlands and other jurisdictions may examine whether Eye Security’s actions fall within existing computer misuse statutes or constitute an unauthorized intrusion. The outcome could shape future guidelines for “good‑samurai” hacking practices, where researchers intervene to stop malicious activity.

For now, users who continue to run Popcorn Time without the disabled updater remain vulnerable. Security professionals advise uninstalling the application or ensuring that any automatic update mechanisms are fully disabled, pending clearer guidance from both the software’s developers and regulatory bodies.