[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-dead-popcorn-time-forks-updater-posed-a-botnet-risk":10,"sections":54},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":42,"persona_id":42,"persona_name":42,"section":43,"tags":44,"sources":49,"feedback":53,"feedback_at":42,"cost_usd":53,"total_tokens":53},12313,"dead-popcorn-time-forks-updater-posed-a-botnet-risk","Dead Popcorn Time Fork's Updater Posed a Botnet Risk","Researchers found an abandoned Popcorn Time fork checking in over unencrypted HTTP with dead domains, and the apps were disabled to head off a botnet.","Abandoned Popcorn Time apps were disabled to keep them from being turned into a botnet, a network of hijacked devices that can be directed to do an attacker's bidding.\n\nResearchers at Eye Security found the updater for a Popcorn Time fork called Time4Popcorn running on Windows, macOS and Android devices around the world. The updater phoned home to web domains that had since been abandoned. It did so over unencrypted HTTP, and it ran an outdated, insecure version of Chrome. Coverage of the findings described the software as installed on millions of devices. Development of the app, which wrapped torrent streaming of movies and TV in a friendly interface, has been dead for years.\n\nThe account does not say who disabled the apps or how, so there is no basis here for saying how many devices are still exposed.\n\nThe combination is what makes the finding matter. An updater is a trusted channel: it tells software what code to fetch and run. When that channel points at domains nobody maintains and travels without encryption, control of it is no longer tied to the developers. Anyone who controls the domain, or sits in the network path, is in a position to answer the app's check-in. An old Chrome build adds known vulnerabilities to the mix.\n\nNone of this requires the app to be popular today. Piracy tools tend to outlive their maintainers because users install them and forget them, and that makes them an unusually poor fit for an update mechanism that still trusts the open internet.\n\nThe lesson is less about piracy than housekeeping: software that checks in with a server nobody owns anymore is a standing offer to whoever picks up the domain.","[\"popcorn-time\",\"botnet\",\"abandoned-software\",\"eye-security\"]","2026-10-23T19:35:15.000Z","2026-10-23T20:04:00.525Z","2026-11-08T00:07:33.051Z","published","Delete the hedge 'The account does not say who disabled the apps or how, so there is no basis here...' because it reads as written from a partial source, and just report that the apps were disabled without speculating on exposure; also cut or soften the unsupported generalization that 'piracy tools tend to outlive their maintainers because users install them and forget them', and attribute the 'millions of devices' figure to The Verge's reporting by name rather than 'coverage'.",[24,30,34,38],{"id":25,"reviewer":26,"round":27,"reason":28,"status":29},"editor-r1","editor",1,"Remove the hedge 'That is our reading of the researchers' findings; the available details do not say anyone abused it,' which reads as written from a truncated source and is process-style text. Also drop or clearly label as analysis the unsupported claims that a lapsed domain could be registered and answer, and that no company can push a fix. Keep the piece to what the source states, and end on a concrete, reader-facing conclusion rather than a speculative open question.","resolved",{"id":31,"reviewer":26,"round":32,"reason":33,"status":29},"editor-r2",2,"The lede and dek say the apps were disabled, but the body never says who disabled them, how, or when, and it describes the updater as 'still running' without reconciling the two; state those specifics from the source or drop the claim, and cut the unsupported assertion that a disabled app still carries the old browser engine.",{"id":35,"reviewer":26,"round":36,"reason":37,"status":29},"editor-r3",3,"The draft no longer claims the apps were disabled, but it now states as current fact that the updater is 'still running' when the source headline says the apps had to be disabled, so say what the source supports (who disabled them and how, or that the source is silent) rather than implying ongoing exposure; also remove the process-sounding phrase 'according to the source material', stop attributing the 'bot army' framing to Eye Security (it is The Verge's wording), and cut the speculation about ",{"id":39,"reviewer":26,"round":40,"reason":22,"status":41},"editor-r4",4,"open",null,"security",[45,46,47,48],"popcorn-time","botnet","abandoned-software","eye-security",[50],{"name":51,"url":52},"The Verge","https:\u002F\u002Fwww.theverge.com\u002Ftech\u002F1017914\u002Fpopcorn-time-piracy-botnet-avoided",0,{"sections":55},[56,61,65,70,75,80,85,90,95,100,105,110,115,120],{"name":57,"slug":58,"count":59,"latest_published_at":60},"AI","ai",7110,"2026-11-08T14:34:09.000Z",{"name":62,"slug":43,"count":63,"latest_published_at":64},"Security",1099,"2026-11-08T15:24:01.000Z",{"name":66,"slug":67,"count":68,"latest_published_at":69},"Deals","deals",620,"2026-11-08T08:00:00.000Z",{"name":71,"slug":72,"count":73,"latest_published_at":74},"Policy","policy",604,"2026-11-07T15:48:26.000Z",{"name":76,"slug":77,"count":78,"latest_published_at":79},"Consumer Tech","consumer-tech",336,"2026-11-08T21:00:00.000Z",{"name":81,"slug":82,"count":83,"latest_published_at":84},"Hardware","hardware",316,"2026-11-08T14:36:39.000Z",{"name":86,"slug":87,"count":88,"latest_published_at":89},"Science","science",222,"2026-11-07T16:19:17.000Z",{"name":91,"slug":92,"count":93,"latest_published_at":94},"Software","software",154,"2026-11-08T15:42:52.000Z",{"name":96,"slug":97,"count":98,"latest_published_at":99},"Startups","startups",150,"2026-11-06T16:50:01.000Z",{"name":101,"slug":102,"count":103,"latest_published_at":104},"Dev Tools","dev-tools",125,"2026-11-06T22:15:59.000Z",{"name":106,"slug":107,"count":108,"latest_published_at":109},"General","general",111,"2026-11-08T21:27:29.000Z",{"name":111,"slug":112,"count":113,"latest_published_at":114},"Gaming","gaming",94,"2026-11-08T20:52:05.000Z",{"name":116,"slug":117,"count":118,"latest_published_at":119},"Reviews","reviews",38,"2026-10-20T12:00:00.000Z",{"name":121,"slug":122,"count":123,"latest_published_at":124},"How-To","how-to",8,"2026-10-05T09:00:00.000Z"]