Molly(Signal fork) has not been updated since 3 months and is vulnerable

Molly is a fork of the Signal encrypted messaging app that has not received any updates for the past three months. The latest official Signal release includes critical security fixes that address vulnerabilities such as insecure key management, potential data leakage, and denial‑of‑service conditions. Because Molly has not incorporated these patches, it remains susceptible to the same exploits that have been mitigated in the mainline application. For enterprise IT teams, this situation is significant because many organizations rely on Signal for secure internal communication. An unpatched messaging app can become a vector for data exfiltration, credential theft, or compliance violations. The vendors involved are the developers of Molly (an independent open‑source project) and the Signal Foundation, which maintains the official app. Mobile device management (MDM) platforms, mobile operating systems (iOS, Android), and app distribution channels are also part of the ecosystem. The broader industry implication is a reminder that forked or community‑maintained software can lag behind upstream security updates, creating hidden risks for enterprises that adopt them. It underscores the need for rigorous app vetting, continuous monitoring of third‑party software, and strict enforcement of approved app catalogs. Failure to address this gap can lead to data breaches, regulatory fines under GDPR or other privacy laws, and damage to incident response timelines. Enterprises must therefore audit their device fleets, enforce the use of the official Signal APK, and establish processes to keep forked applications under scrutiny.