"Notifications marked for deletion could be unexpectedly retained on the device," reads Apple's security bulletin.
Apple issued out‑of‑band fixes on April 22, 2026 (CVE-2026-28950)
Apple released emergency security updates on April 22, 2026, to address a Notification Services flaw tracked as CVE-2026-28950. The fixes shipped in iOS 26.4.2 and iPadOS 26.4.2, and in parallel iOS 18.7.8 and iPadOS 18.7.8. Apple described the issue succinctly: notifications that users had marked for deletion could remain stored on the device.
According to the advisory, the flaw was resolved through “improved data redaction.” Apple labeled the releases out‑of‑band, meaning they were made outside the company’s normal update cadence.
Apple's disclosure and the limits of its public description
Apple provided no additional technical detail beyond the brief bulletin. The company did not say whether the flaw had been exploited in real‑world attacks, nor did it explain why it chose to push an out‑of‑cycle update. Apple also did not quantify how long deleted notification data could remain on a device or describe how such data might be recovered.
BleepingComputer contacted Apple with questions about the updates but, at the time of publication, had not received a response.
Reporting, trial notes, and recovered Signal notifications
Independent reporting by 404 Media has drawn a direct line between the advisory’s symptom and a concrete law‑enforcement recovery described in trial material. 404 Media reported that the FBI recovered copies of Signal messages from a suspect’s iPhone even after those messages had been deleted in the Signal app.
Notes from a trial, published by supporters of the defendants, state that the recovered data did not come from Signal’s encrypted message store but instead “from iPhone's notification storage.” The notes include the line: “Messages were recovered from Sharp's phone through Apple's internal notification storage — Signal had been removed, but incoming notifications were preserved in internal memory.”
Apple’s advisory does not reference this case, but its description of retained deleted notifications closely aligns with the persistence described in the trial notes and 404 Media’s reporting.
Immediate steps for users: install updates and adjust Signal notification content
- Install the updates: Apple advised users to install the latest iOS and iPadOS updates as soon as possible to prevent deleted notification data from being unexpectedly retained. The specific builds named by Apple are iOS 26.4.2, iPadOS 26.4.2, iOS 18.7.8 and iPadOS 18.7.8.
- Mitigate Signal notification exposure: To avoid Signal message content being retained in iOS notification storage, users can change Signal’s notification content setting. In the app go to Signal Settings > Notifications > Notification content and set Show to “Name Only” or “No Name or Content.”
How technologists, legal teams, and end users should respond
- Technologists and security teams: prioritize deployment of the named iOS and iPadOS updates and, where feasible, examine how notification storage is handled in device images and backups. The bulletin’s mention of “improved data redaction” will likely prompt technical teams to validate that redaction is effective in their environments.
- Prosecutors and defense counsel in relevant cases: the trial notes and 404 Media reporting assert that recovered messages came from iPhone notification storage rather than an app’s encrypted message store, which raises concrete questions about forensic provenance and the sources of digital evidence.
- End users and device owners: follow Apple’s advice to update devices promptly and, if concerned about message visibility in notifications, change the Signal notification content setting to reduce what is stored in iOS notification data.
Apple’s bulletin fixes a narrowly described but potentially consequential gap: deleted notifications that linger where users expect privacy. The company’s statement that redaction was improved answers the “how” at a high level, but two concrete questions remain unanswered in Apple’s public material — whether the flaw was ever exploited in the wild, and why Apple issued an out‑of‑cycle patch. Until Apple provides further detail, the practical imperative is clear: apply the named updates and consider tightening notification display settings for sensitive messaging apps.
Source: BleepingComputer — Apple fixes iOS bug that retained deleted notification data
