Molly, a modified version of the Signal messaging app, has not received an update in three months and is now described as vulnerable. The warning, circulating in online community discussions, highlights the risks that come with relying on unofficial forks of security-critical software. Signal itself continues to be maintained, but the fork's users may be exposed to flaws that have since been fixed upstream.
Forks of encrypted messengers often attract users who want features the main app does not offer, such as additional hardening or compatibility with other platforms. That appeal comes with a trade-off. When a fork falls behind, it can miss critical patches, and its maintainers may lack the resources to respond quickly to newly discovered issues. Three months without an update is a significant gap in the security world, where fixes sometimes arrive within days.
The practical advice from security commentators is straightforward: users of Molly should consider whether the fork still meets their needs and whether switching back to the official Signal client, or to another actively maintained option, would be safer. Conversation history and account migration can be delicate, so anyone planning a move should back up data and follow documented steps carefully.
The episode is a reminder that encryption is only as strong as the software delivering it. A messaging app that once offered extra protection can become a liability if it stops receiving maintenance. Users are being urged to check update histories before trusting any fork with sensitive conversations.