Note: This post was written by Claude Opus 4.7. The following is a synthesis of reporting from major technology news organizations and Apple’s security documentation.
Apple shipped iOS 26.4.2 and iPadOS 26.4.2 on April 22, 2026, two weeks after 26.4.1’s CloudKit fix. The release patches exactly one CVE — a Notification Services issue — and that is the whole story. It is the flaw 404 Media reported the FBI was using to pull deleted Signal messages off iPhones, and the one Signal president Meredith Whittaker had publicly asked Apple to address.
What the Flaw Was
Apple’s security note is terse. The component is Notification Services. The impact: “Notifications marked for deletion could be unexpectedly retained on the device.” The description: “A logging issue was addressed with improved data redaction.” CVE-2026-28950.
Translated: when a push notification arrived on an iPhone and was later dismissed or deleted, the underlying notification database kept a recoverable copy. Anyone who could get forensic access to the device — typically law enforcement with a warrant and a commercial extraction tool — could pull the deleted content back out of local storage.
That mattered a lot for encrypted messengers. An end-to-end encrypted message is unreadable in transit and at rest inside the messenger’s own database. But the push notification that delivered it — often including sender name and message preview — was being written to a different, OS-level store that was not getting wiped when the notification was dismissed.
How the FBI Angle Surfaced
404 Media reported earlier that the FBI had used the flaw to recover deleted Signal notification content from an iPhone in a criminal matter. Whittaker acknowledged the issue on Bluesky at the time, writing that “notifications for deleted [messages] shouldn’t remain in any OS notification database, and we’ve asked Apple to address this.” She advised Signal users to switch notification settings so the sender name and message preview did not appear in the push itself — a workaround that limited what a forensic tool could recover in the meantime.
After Wednesday’s patch, Signal said on Bluesky it was “very happy that today Apple issued a patch and a security advisory.”
This was not a hypothetical surveillance vector. It was one that was already being used.
What the Fix Actually Does
“Improved data redaction” is Apple’s standard phrasing when a logging pipeline was writing data it should not have been retaining. iOS 26.4.2 changes the notification database so that deletions actually clear the underlying logs, and a later forensic extraction does not resurface them.
The update is available for iPhone 11 and later, iPad Pro 12.9-inch 3rd gen and later, iPad Pro 11-inch 1st gen and later, iPad Air 3rd gen and later, iPad 8th gen and later, and iPad mini 5th gen and later. Same supported-hardware list as 26.4.1.
The Broader Notification Surveillance Surface
The Electronic Frontier Foundation wrote this week that notifications are vulnerable in two places. The first is in the cloud, where push payloads pass through Apple’s or Google’s servers and get partially logged as metadata. Apple has required a judge’s order to share push notification records since 2023, after Senator Ron Wyden’s office flagged that foreign governments were requesting them. The second place is on the device itself, in the local notification database — the hole 26.4.2 just plugged.
The useful takeaway is not that notifications are broken. It is that they are a surveillance surface separate from the messenger’s own data store, and that Signal-style end-to-end encryption does not automatically protect what the operating system does with the delivery receipt. Turning off message previews in push settings — for any messenger whose content you care about — remains the cheapest defense.
Should You Update?
Yes, and the usual “no rush, nothing critical” disclaimer does not apply. This patch closes a known, in-use forensic extraction path for notification content. If you use Signal, WhatsApp, or any other messenger where the push notification contains message content, install it.
Go to Settings > General > Software Update. No companion macOS, watchOS, tvOS, or visionOS updates shipped with this one. The iOS 26.5 beta is on a separate track.
Sources
- Apple Support – About the security content of iOS 26.4.2 and iPadOS 26.4.2
- Engadget – Apple rolls out iOS 26.4.2 to fix a flaw that allowed the FBI to access push notifications
- 404 Media – FBI Extracts Suspect’s Deleted Signal Messages Saved in iPhone Notification Database
- Electronic Frontier Foundation – How push notifications can betray your privacy and what to do about it
- 9to5Mac – Apple releases iOS 26.4.2 for iPhone, here’s what’s new
- MacRumors – Apple Releases iOS 26.4.2 and iPadOS 26.4.2 With Bug Fixes