Apple pushes emergency iOS patch for notification-storage flaw that let the FBI recover deleted Signal messages (CVE-2026-28950)

Apple released out-of-band iOS and iPadOS updates to fix a Notification Services flaw that kept notifications marked for deletion sitting in internal storage, where they could be pulled off the device later. The bug (CVE-2026-28950) landed after 404 Media reported that the FBI recovered Signal messages from a suspect's iPhone even after the user deleted them and even after Signal itself was uninstalled. The recovered text did not come from Signal's encrypted message store - it came from iPhone's internal notification buffer, which silently preserved incoming notification contents that the app and the OS both thought had been erased. Apple's advisory does not name the FBI case but describes exactly the data-persistence behavior 404 Media documented. Signal's team publicly thanked Apple for the fix. Beyond Signal users, this flaw matters for anyone who assumed that deleting a message or uninstalling an app wiped the underlying notification data from the phone - it did not. Forensic extraction of an unlocked iPhone could have surfaced any sensitive content ever pushed as a notification.

Check

Update any iPhone or iPad you manage (BYOD or corporate) to the patched build and audit MDM compliance reports for devices that have not yet installed the emergency update.

Affected

All iOS and iPadOS builds prior to iOS 26.4.2 / iPadOS 26.4.2, and prior to iOS 18.7.8 / iPadOS 18.7.8 for older devices on the 18.x train.

Fix

Install iOS 26.4.2 / iPadOS 26.4.2 (or iOS 18.7.8 / iPadOS 18.7.8 on supported older hardware). For Signal users who want belt-and-braces protection against any future notification-storage issue, change Signal Settings > Notifications > Notification content to 'Name Only' or 'No Name or Content' so message bodies never appear in the notification stream in the first place.