Apple on Wednesday announced fresh iOS and iPadOS updates that address a vulnerability allowing the recovery of deleted messages.
Tracked as CVE-2026-28950, the bug is described as a logging issue resulting in notifications that have been marked for deletion to be retained on the device.
According to Apple, the newly released iOS 26.4.2, iPadOS 26.4.2, iOS 18.7.8, and iPadOS 18.7.8 platform refreshes address the flaw by improving data redaction.
The security updates are available for dozens of iPhone and iPad models and generations, ranging from iPhone XR and iPhone XS to iPhone 16 and iPhone 16e, and from 5th generation iPad mini to iPad Pro 13-inch (M4).
Apple did not share further details on CVE-2026-28950, nor did it mark the security defect as being exploited in the wild.
However, it appears that the vulnerability was exploited by law enforcement to extract Signal messages from the iPhone of an alleged Antifa member, a suspect in the Prairieland case.
The FBI reportedly exploited iOS’s notification issue to retrieve the Signal chats although they had been set to disappear and the messaging application was uninstalled from the device.
The vulnerability resulted in previews of incoming messages to be saved to system cache, and they could later be scrapped using forensic tools.
Shortly after Apple rolled out the fixes, Signal praised it for taking quick action to preserve users’ privacy.
“Note that no action is needed for this fix to protect Signal users on iOS. Once you install the patch, all inadvertently-preserved notifications will be deleted and no forthcoming notifications will be preserved for deleted applications,” Signal said.
In an emailed comment, Jamf senior enterprise strategy manager Adam Boynton underlined the impact the vulnerability has on enterprise users:
A forensic examiner reconstructing notifications a user believed were deleted is reading a compressed timeline of someone’s working life. They include the likes of two-factor codes, previews from work chat platforms, calendar invites, customer alerts, and even internal security pings.
The FBI and Signal case is eye-catching, but the underlying exposure applies to any app that surfaces content in push notifications, which is most enterprise collaboration tools in daily use.
*Updated with comment from Jamf.
Related: Oracle Patches 450 Vulnerabilities With April 2026 CPU
Related: Progress Patches Multiple Vulnerabilities in MOVEit WAF, LoadMaster
Related: Dozens of Malicious Crypto Apps Land in Apple App Store
Related: Fortinet Rushes Emergency Fixes for Exploited Zero-Day
