Recently, the FBI recovered old Signal messages from a suspect’s iPhone, despite the messages and the app having been deleted. Now, Apple has fixed the loophole that allowed it to happen.
Signal is a popular secure messaging app, so the news that the FBI had extracted Signal messages from an iPhone was concerning for Signal users, even though the bug originated with Apple, not Signal itself. In this case, the FBI was able to recover deleted Signal messages from the suspect’s iPhone notifications.
The news comes courtesy of BleepingComputer, which noticed that a small security update was issued to iPhones and iPads to theoretically rectify the issue. In an Apple security bulletin, the company noted that a bug called “CVE-2026-28950” had been fixed. Apple didn’t provide a lot of specificity here, but its official description of the bug seems right in line with the Signal notifications loophole: “Notifications marked for deletion could be unexpectedly retained on the device.”
If you haven’t already, update your iPhone to iOS 26.4.2 to take advantage of the security update.
Mashable Light Speed
Signal even thanked Apple for doing this on X.
This Tweet is currently unavailable. It might be loading or has been removed.
The Signal bug in question, originally reported by 404 Media, involved deleted and end-to-end encrypted messages extracted from iPhone push notifications. Since the notifications contained the text of the message, and the iPhone didn’t delete them in a timely fashion, the FBI was able to read them.
While Apple’s security update didn’t mention this story, it seems fairly obvious that this update was meant to address this particular bug. Moving forward, old notifications will be deleted instead of retained.
As a reminder, Signal users can also avoid this problem by going to the app’s Settings menu, tapping “Notification,” then “Notification Content,” and then finally choosing “No Name or Content.” If you do that, your push notifications will merely alert you to the presence of a message without spoiling its sender or contents for you — or for anyone else who might get a warrant for your device in the future.
Users running iOS 26.4.2 (and iOS 18.7.8) will get the benefits of the latest security update. Users whose iPhones are running older software should ensure their push notification settings are up to date.
