Security researchers have disabled an abandoned Popcorn Time updater on 2 million systems to prevent malicious abuse.