Molly Signal fork unpatched for three months, lags behind fixes shipped in mainline Signal

Three months without a release

A post that reached the front page of Hacker News in late October warns that Molly, a popular community-maintained fork of Signal for Android, has gone roughly three months without a release and is missing security fixes that the official Signal app has already shipped.

According to the post, Molly's most recent version is v8.19.2-4, released on 31 July. Mainline Signal has continued to update in the interim; the author points to an exploit disclosed in October that was addressed in Signal 8.27.1, while Molly, built on an older snapshot of the code, remains open to it. The post does not describe the exploit in detail, and it includes no response from Molly's maintainers.

How fork maintenance fails quietly

Signal publishes its Android source code openly, which is what allows projects like Molly to exist: maintainers take the official code, layer on their own additions — Molly is known for extra privacy-oriented options — and rebuild the app. The model carries a built-in weakness, though. Every upstream release, including routine security patches, has to be merged downstream by the fork's maintainer. If that work pauses, nothing obvious breaks: the app keeps launching, messages keep sending, and the code underneath quietly falls out of date.

The gap also compounds. Three months of skipped merges makes the next update larger and more laborious to produce, which can slow a stalled project further rather than snapping it back to speed.

What the post recommends

The author's advice is blunt: switch back to mainline Signal and remove Molly until the fork resumes a normal release cadence, which the post doubts will happen at all.

That is one user's assessment rather than an official advisory, and the specific version numbers cited rest on a single source. The practical check is simple, though: the project's own public release history will show whether anything newer than v8.19.2-4 has shipped since July. If it has not, the substance of the warning holds regardless of how it is phrased.

Why it matters

Privacy-minded users gravitate to forks like Molly precisely because they promise more hardening than the mainstream app. This episode is a reminder of the trade-off: those guarantees depend entirely on a maintainer keeping pace with upstream patches, and a hardening fork running three months behind is, in practice, less secure than the app it set out to improve.

The broader lesson applies to any security-sensitive fork of any project — messaging clients, browsers, operating systems. The right question is not only which features the fork adds, but how quickly it ships the fixes it inherits. A stalled fork of a secure app is not a neutral choice; it is an exposure.