iPhone Notification Cache Exposed Deleted Signal Messages
Apple’s fix is not about Signal breaking. It is about iOS keeping copies of message previews after the app and the messages were supposed to disappear. That means device-level notification storage can defeat app-level privacy controls, and patching only closes the retention bug, not the fact that the content was already recoverable.
Apple says CVE-2026-28950 was a Notification Services logging issue that retained notifications marked for deletion. The fix is in iOS 26.4.2 and iPadOS 26.4.2 for newer devices, and iOS 18.7.8 and iPadOS 18.7.8 for older ones. Reporting and Signal’s confirmation tie the flaw to FBI recovery of Signal message previews from an iPhone, even after the app was deleted and disappearing messages were enabled.
The forward risk is broader than one app or one case. Any workflow that treats disappearing messages as a hard control now has to account for OS caches, lock-screen previews, and forensic access to the device itself.