piefed.worldBrowse aymeric's, an independent, searchable archive of readable snapshots from followed feeds, preserved in Git with aggr.https://aggr.aymericbeaumet.com/sources/piefed.world/2026-10-31T10:23:41+00:00aymeric'saggrurn:aggr:item:8803a3788d17c2aa21d87bbbebe7bcc02681db3eMolly(Signal fork) has not been updated since 3 months and is vulnerable2026-10-31T10:23:41+00:002026-10-31T10:23:41+00:00DeepLoginHacker News: Front Pagecross-posted from: https://piefed.world/c/ysk/p/1503393/ysk-molly-signal-fork-has-not-been-updated-since-3-months-and-is-vulnerable-to-attacks-f As of now, Molly lastest release was in 31 July (Version v8.19.2-4). It contains…<p>cross-posted from: <a target="_blank" rel="noopener noreferrer" href="https://piefed.world/c/ysk/p/1503393/ysk-molly-signal-fork-has-not-been-updated-since-3-months-and-is-vulnerable-to-attacks-f">https://piefed.world/c/ysk/p/1503393/ysk-molly-signal-fork-has-not-been-updated-since-3-months-and-is-vulnerable-to-attacks-f</a></p>
<p>As of now, Molly <a target="_blank" rel="noopener noreferrer" href="https://github.com/mollyim/mollyim-android/releases">lastest release</a> was in 31 July (Version v8.19.2-4).</p>
<p>It contains vulnerabilities that had been simply fixed in mainline Signal.</p>
<p>Take for example the <a target="_blank" rel="noopener noreferrer" href="https://www.privacyguides.org/news/2026/10/22/signal-vulnerability-allow-audio-and-possibly-video-to-continue-after-hanging-up/">latest exploit disclosed in October</a>, it has been fixed in Signal 8.27. <a target="_blank" rel="noopener noreferrer" href="https://aboutsignal.com/news/signal-fixes-bug-that-could-affect-ending-calls-on-android/">1</a>. Meanwhile Molly remains vulnerable.</p>
<p>It’s currently recommended to use mainline Signal and delete Molly till they at least return to updating their app adequately, if they ever will.</p>