Apple fixes bug that let the FBI recover deleted Signal messages

Apple has released out-of-band security updates for iPhone and iPad devices to fix a Notification Services flaw that could allow notifications marked for deletion to remain stored on the device.

The bug, tracked as CVE-2026-28950, was fixed on April 22, 2026, in iOS 26.4.2 and iPadOS 26.4.2 and in iOS 18.7.8 and iPadOS 18.7.8.

“Notifications marked for deletion could be unexpectedly retained on the device,” reads the Apple security bulletin.

Apple says the flaw was fixed through improved data redaction but provided no additional information.

However, the company has not said whether the flaw was exploited in attacks or why it was addressed outside the normal security update cycle. Apple also did not share technical details about how long notification data remained on the device or how it could potentially be recovered.

While Apple has not explained why it released this emergency update, recent reporting by 404 Media described how the FBI recovered copies of Signal messages from a suspect’s iPhone, even after they had been deleted in the app.

According to trial notes published by supporters of the defendants, the recovered data did not come from Signal’s encrypted message store, but instead from iPhone’s notification storage.

“Messages were recovered from Sharp’s phone through Apple’s internal notification storage — Signal had been removed, but incoming notifications were preserved in internal memory,” the notes state.

Signal has commended Apple for the action to patch a vulnerablitity that threatened the safety of private conversations.

“We’re grateful to Apple for the quick action here, and for understanding and acting on the stakes of this kind of issue. It takes an ecosystem to preserve the fundamental human right to private communication,” Signal said in a public statement.

404 also reported the notification data was retained even after Signal was deleted from the device.

Apple’s advisory does not reference the case, but its description of notifications being retained on the device closely aligns with the type of data persistence described in that report.

Users are advised to install the latest updates as soon as possible to prevent deleted notification data from being unexpectedly retained on their devices.

Furthermore, it is possible to prevent Signal message content from being retained in the iOS notification data storage by going to Signal Settings > Notifications> Notification content and setting Show to “Name Only” or “No Name or Content”.

GeekFeed contacted Apple with questions about these updates, but has not yet received a response.