Apple fixes iPhone bug that allowed others to see your deleted messages

The FBI could read messages on your iPhone, even after you deleted them, claimed a report, after US authorities allegedly managed to read deleted Signal messages on an iPhone. This sparked concerns online with even Signal CEO Meredith Whittaker chiming in. Now, Apple has released a security update for iPhones and iPads, which likely fixes this bug.
In a release, Apple stated that the iOS 26.4.2 and iPadOS 26.4.2 updates were meant to address a bug where “notifications marked for deletion could be unexpectedly retained on the device.” Do note that Apple does not address this report directly in its release.
As per a report by 404 Media, the FBI was able to extract deleted Signal messages from an iPhone “using forensic tools” in a case, because copies of the content were saved in the device’s “push notification database.” As per reports, this data was stored on the device for up to a month, even if the original messages were deleted.
Signal’s CEO Meredith Whittaker wrote on Bluesky, “Notifications for deleted messages shouldn’t remain in any OS notification database.” Signal is a privacy-focused messaging platform, which pitches itself as an alternative to apps like WhatsApp.
Apple has released a security patch for iPhones and iPads. The company, however, does not explicitly address the reported FBI incident. The release for the update states, “For our customers’ protection, Apple doesn’t disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available.”
The bug, identified as CVE-2026-28950, was corrected through improved data redaction. However, Apple has not disclosed whether this vulnerability was exploited in attacks or provided details on how long notification data was retained or could be recovered.
Following the update, Signal posted on X, “We’re grateful to Apple for the quick action here, and for understanding and acting on the stakes of this kind of issue. It takes an ecosystem to preserve the fundamental human right to private communication.” The company stated that Signal users did not need to do anything extra after installing the update.
Apple has urged users to install the new security patch. According to the company’s website, the iOS 26.4.2 update is available for iPhone 11 and later models. While iPadOS 26.4.2 is available for “iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later.”