Apple fixes iOS bug that retained deleted notification data

Source: Bleeping Computer

Apple has released out‑of‑band security updates for iPhone and iPad devices to fix a Notification Services flaw that could allow notifications marked for deletion to remain stored on the device.

The bug, tracked as CVE‑2026‑28950, was fixed on April 22, 2026, in:

• iOS 26.4.2 and iPadOS 26.4.2
• iOS 18.7.8 and iPadOS 18.7.8

“Notifications marked for deletion could be unexpectedly retained on the device,” reads the Apple security bulletin.

Apple says the flaw was fixed through improved data redaction but provided no additional information. The company has not said whether the flaw was exploited in attacks or why it was addressed outside the normal security‑update cycle. Technical details about how long notification data remained on the device or how it could potentially be recovered were also omitted.

Related FBI case

Recent reporting by 404 Media described how the FBI recovered copies of Signal messages from a suspect’s iPhone, even after they had been deleted in the app. According to trial notes published by supporters of the defendants, the recovered data did not come from Signal’s encrypted message store but from the iPhone’s notification storage:

“Messages were recovered from Sharp’s phone through Apple’s internal notification storage — Signal had been removed, but incoming notifications were preserved in internal memory.” – court notes

404 Media also reported that the notification data was retained after Signal was deleted from the device. Apple’s advisory does not reference this case, but its description of notifications being retained aligns with the persistence described in the report.

Mitigation

• Update your device: Install the latest iOS 26.4.2/iPadOS 26.4.2 or iOS 18.7.8/iPadOS 18.7.8 updates as soon as possible.
• Adjust Signal notification settings: To prevent Signal message content from being stored in iOS notification data, go to Signal Settings → Notifications → Notification content and set Show to “Name Only” or “No Name or Content”.

BleepingComputer contacted Apple for comment on these updates but has not yet received a response.