CVE-2026-28950
EPSS 3% (85th percentile), up from 0.02%.
Vulnerabilities · 145 days ago
Apple’s fix is not about Signal breaking. It is about iOS keeping copies of message previews after the app and the messages were supposed to disappear. That means device-level notification storage can defeat app-level privacy controls, and patching only closes the retention bug, not the fact that the content was already recoverable.
Apple says CVE-2026-28950 was a Notification Services logging issue that retained notifications marked for deletion. The fix is in iOS 26.4.2 and iPadOS 26.4.2 for newer devices, and iOS 18.7.8 and iPadOS 18.7.8 for older ones. Reporting and Signal’s confirmation tie the flaw to FBI recovery of Signal message previews from an iPhone, even after the app was deleted and disappearing messages were enabled.
The forward risk is broader than one app or one case. Any workflow that treats disappearing messages as a hard control now has to account for OS caches, lock-screen previews, and forensic access to the device itself.
EPSS 3% (85th percentile), up from 0.02%.
7 sources covering this story
Apple Fixes iOS Flaw That Let FBI Recover Deleted Signal Messages
Apple fixes CVE-2026-28950 in iOS 26.4.2 after deleted notifications were retained, mitigating forensic data exposure.
Apple Fixes iOS Notification Bug Exposing Deleted Messages
Apple patches iOS flaw that retained deleted notifications, exposing message data
Security updates for iPhones and iPads fix CVE-2026-28950, a vulnerability that made devices retain notifications marked for deletion.
FBI Extracts Deleted Signal Messages from iPhone Notification Database - Schneier on Security
404 Media reports (alternate site): The FBI was able to forensically extract copies of incoming Signal messages from a defendant’s iPhone, even after the app was deleted, because copies of the content were saved in the device’s push notification database….
Apple Patches iOS Flaw Allowing Recovery of Deleted Chats
Apple rolled out the security patches for dozens of iPhone and iPad models and generations.
Apple fixes bug that cops used to extract deleted chat messages from iPhones | TechCrunch
The iPhone and iPad bug allowed law enforcement using forensic tools to read messages that had long been deleted by the Signal app.
Apple fixes bug that let the FBI recover deleted Signal messages
Apple has released out-of-band security updates for iPhone and iPad devices to fix a Notification Services flaw that could allow notifications marked for deletion to remain stored on the device.
Part of the PlainSec briefing for 2026-04-24