Severity: High | Priority: 1
This update adds 40 policy signatures that detect hosts in your network running the abandoned Time4Popcorn fork of Popcorn Time. This fork, once one of the most widely used BitTorrent streaming clients, installs a background updater that starts with the operating system. The updater checks for new versions over unencrypted HTTP from a fixed set of 20 domains. It installs whatever it receives without verifying a code signature. On Windows and macOS this happens silently and runs with full system privileges (SYSTEM on Windows, root on macOS). Many of these update domains lapsed and could be registered by anyone, so whoever controls one can run arbitrary code on every machine that calls it. The issue is tracked as CVE-2026-30612 and is rated critical.
The recommended action is to uninstall Popcorn Time from every flagged host. Disabling the updater alone does not make the application safe, because it also runs an outdated browser engine with its sandbox turned off, uses unencrypted connections, and loads scripts from other abandoned domains. Where immediate removal is not possible, stop and disable the “Update service” on Windows, or unload the PT.updd launch daemon on macOS, as an interim measure. On Android the updater cannot be disabled separately, so removing the app is the only fix. Administrators who want to stop these beacons at the perimeter while cleanup is under way can switch the signatures from alert to drop in the GajIPS policy.