iPhone notification storage kept deleted Signal messages; Apple fixes CVE-2026-28950 in iOS 26.4.2
iPhones could keep notification previews, including Signal message text, after the app was deleted; the FBI reportedly recovered messages this way. Apple fixed it on 22 April (CVE-2026-28950). Update to iOS or iPadOS 26.4.2 (or 18.7.8) and hide previews on the Lock Screen.
Update your iPhone and iPad to iOS or iPadOS 26.4.2 (or 18.7.8 if you are on iOS 18) in Settings > General > Software Update. In Signal, set notifications to show no name or message content, and consider hiding previews on the Lock Screen for other messaging apps.
- iOSfixed in 26.4.2 and later
- iPadOSfixed in 26.4.2 and later
What’s happening
In April 2026, 404 Media reported that the FBI recovered the text of incoming Signal messages from a defendant's iPhone even though the Signal app had been deleted. The copies sat in the iPhone's push notification database, not in Signal's own encrypted storage, so they survived deletion of the app. The case involved an alleged attack on the Prairieland ICE detention facility in Texas. On 22 April 2026 Apple released iOS 26.4.2 and iPadOS 26.4.2, fixing CVE-2026-28950 in Notification Services, where notifications marked for deletion could be retained on the device. Apple described it as a logging issue fixed by better data redaction. BleepingComputer reports the fix also covers iOS 18.7.8 and iPadOS 18.7.8. Apple's advisory does not mention the FBI case, and Apple has not confirmed a link. The issue is not specific to Signal: any app that shows message previews in notifications could be affected. Signal has said it is grateful to Apple for the quick action. No reports of criminal use of this flaw have been published. Messages already retained before the update are the part reporting does not clearly settle.
- What
- Flaw
- Affects
- Apple iPhone and iPad (iOS and iPadOS 26 and 18) notification storage
- Affected
- iPhone 11 and later and supported iPad models running iOS/iPadOS before 26.4.2
iOS and iPadOS 18 before 18.7.8 (per BleepingComputer) - Fixed in
- iOS 26.4.2
iPadOS 26.4.2
iOS 18.7.8
iPadOS 18.7.8 - Since
- 9 Apr 2026
- Closed
- 22 Apr 2026
Timeline
- Update
BleepingComputer reported the same fix also reached iOS 18.7.8 and iPadOS 18.7.8, said Apple has not confirmed any link to the FBI case, and quoted Signal thanking Apple for acting quickly.
- New fixFixed
Apple released iOS 26.4.2 and iPadOS 26.4.2 fixing CVE-2026-28950, where notifications marked for deletion could be kept on the device. Apple called it a logging issue fixed with better data redaction and did not mention the FBI case.
- Update
9to5Mac covered the report the same day. The 404 Media article suggested Signal users may want to switch on the setting that keeps message content out of notifications.
- Made publicNo fix yet
404 Media reported that FBI forensic extraction of a defendant's iPhone in the Prairieland detention facility case recovered copies of incoming Signal messages from the iPhone's push notification database, after the Signal app had been deleted.
Sources
- About the security content of iOS 26.4.2 and iPadOS 26.4.2Apple · 22 Apr 2026
- FBI extracts suspect's deleted Signal messages saved in iPhone notification database404 Media · 9 Apr 2026
- FBI used iPhone notification data to retrieve deleted Signal messages9to5Mac · 9 Apr 2026
- Apple fixes iOS bug that retained deleted notification dataBleepingComputer · 22 Apr 2026