Apple has released iOS 26.4.2 and iPadOS 26.4.2 to fix a privacy issue that could cause deleted app notifications, including message content, to persist on devices.
The update directly addresses concerns raised after reports revealed that law enforcement could recover Signal message data from iPhone notification storage even after the app had been removed.
The security update patches a vulnerability tracked as CVE-2026-28950 in Apple’s Notification Services. According to Apple, the flaw was caused by a logging issue that resulted in notifications marked for deletion being unexpectedly retained on the device. The company says the problem has now been resolved through improved data redaction, ensuring that such residual notification data is no longer stored beyond its intended lifecycle.
The fix follows closely on the heels of revelations about how the FBI extracted Signal message fragments from an iPhone as part of a criminal investigation tied to a 2025 attack on the Prairieland ICE Detention Facility in Texas. During court testimony, FBI Special Agent Clark Wiethorn explained that investigators were able to access incoming messages preserved in Apple’s internal notification database, despite the Signal app having been uninstalled from the device.
That revelation sparked widespread concern, as it highlighted how sensitive communications could persist outside encrypted applications in system-level storage. When notification previews are enabled, the operating system can store portions of incoming messages locally, creating forensic artifacts that may remain accessible even after an app is deleted or messages are configured to disappear. Investigators reportedly recovered only incoming messages, since outgoing communications are not handled through the same notification mechanism.
In a public statement, Signal welcomed the fix, noting that once users install the update, any inadvertently preserved notifications will be deleted automatically, and future notifications from deleted apps will no longer be retained. Signal also emphasized that no additional user action is required beyond installing the patch.
Of course, the issue is not limited to Signal. Any messaging app that displays content in notifications could be affected, since the root cause lies within Apple’s notification framework rather than third-party software. Hence, Apple’s update addresses this risk across all apps and the sensitive data they process.
Users are strongly advised to install iOS 26.4.2 or iPadOS 26.4.2 as soon as possible. For additional privacy safeguards, users should consider disabling message previews on the lock screen or limiting notification content visibility, reducing the chances that sensitive data is stored in system-level logs or exposed through forensic analysis.
Leave a Reply