Privacy-Focused Signal Fork Molly Left Vulnerable Due to Stalled Updates

Molly, a popular alternative client for privacy enthusiasts, has gone unpatched for months, leaving users exposed to vulnerabilities already fixed in mainline Signal.

The maintenance challenges of open-source software forks highlight ongoing security risks within privacy-centric mobile ecosystems. Molly, a specialized fork of the encrypted messaging client Signal known for supporting UnifiedPush without Google Play Services, has not received an update since July 31.

Security disclosures patched in mainline Signal throughout recent months remain unaddressed in Molly's codebase. Security advocates are currently recommending that users transition back to mainline Signal or MicroG-supported configurations until the project resumes active maintenance cycles.