The open-source project says it is still investigating and hasn’t given a loss figure or announced a fix. Its founder said the reports appear to involve versions older than 2.4.2.