CVE-2026-28950: How iOS 26.4.2 Closes the Notification Retention Flaw
The latest iOS 26.4.2 update is a minor but crucial release for iPhone users, focusing entirely on security and bug fixes rather than new features. While Apple is expected to unveil iOS 27 at WWDC soon and is currently beta testing iOS 26.5, this update is available right now for iPhones and iPads via Settings → General → Software Update.
🔐 A Critical Security Fix
Apple’s release notes are typically sparse, stating only that the update “provides bug fixes and security updates for your iPhone.” However, the company’s security support page reveals the sole fix is for a significant vulnerability in Notification Services. The issue was that “notifications marked for deletion could be unexpectedly retained on the device”. This meant that even after a user cleared a notification, or even deleted an entire app, a copy of that notification data could linger in the device’s storage.
🕵️ The FBI and Signal Connection
While Apple did not explicitly say so, the urgency of this fix is almost certainly in response to a report by 404 Media. The report detailed how the FBI was able to recover deleted Signal messages from a suspect’s iPhone by accessing the phone’s internal notification database. In that case, the Signal app had been deleted and its messages were set to disappear, but notification previews—which contained the message content—had been retained on the device. This posed a significant privacy risk, as it effectively bypassed Signal’s end-to-end encryption for those stored notification previews.
🛠️ What the Update Does
iOS 26.4.2 fixes the underlying logging issue by improving data redaction. Importantly, Apple has confirmed that this update doesn’t just prevent the problem going forward; it also retroactively purges any notification copies that were mistakenly stored on the device from before the update. The vulnerability has been assigned the identifier CVE-2026-28950. This security fix is also available for users on older operating systems via iOS and iPadOS 18.7.8.
📅 What About New Features?
Users hoping for new features in this release will be disappointed. Those are not expected until iOS 26.5 next month, which is rumored to include Apple Maps changes and end-to-end encrypted RCS messaging. This release comes just a couple of weeks after iOS 26.4.1, which addressed iCloud sync issues.
Given the serious nature of the security vulnerability, all users are strongly advised to install the iOS 26.4.2 update as soon as possible to protect their device’s data.
