Apple Patches the FBI's Signal Loophole: What iOS 26.4.2 Actually Fixes

Apple shipped iOS 26.4.2 on 22 April 2026 to close a flaw that allowed the FBI to extract Signal messages from an iPhone — even after the user deleted the Signal app and had disappearing messages turned on. The bug, tracked as CVE-2026-28950, was a logging issue in iOS's notification database: messages flagged for deletion were unexpectedly retained. The patch is now available across the supported lineup. If you have not updated, do it tonight.

What actually broke

The vulnerability is not in Signal. It is in iOS itself, specifically in how the operating system stages incoming notifications before they are delivered to an app and disposed of. According to Apple's security advisory, notifications marked for deletion were being preserved in the system's internal notification database long after the app that received them had been removed and the messages themselves had been told to disappear. Apple's fix is described as "improved data redaction" — meaning the OS now scrubs the relevant fields when a notification is dismissed, rather than retaining them.

The practical result was that an attacker (or a forensic examiner with physical access and the right tooling) could pull Signal message previews — sender, snippet, sometimes full text depending on notification settings — from the iPhone even when:

1. The Signal app had been uninstalled.
2. Disappearing messages had been configured.
3. The user believed they had taken every reasonable step to remove the messages.

This is not a Signal flaw. Any messaging app that uses iOS notifications — that is, all of them — was affected the same way. Signal got the headline because the underlying FBI case involved Signal traffic.

How the FBI actually used it

The defendant in the underlying case had deleted the Signal app and had disappearing messages enabled. The iPhone, however, retained the messages in its notification database long enough for federal investigators to extract them — not from Signal's servers (which never had them), and not from the app's local storage (which had been removed), but from a system-level database the user had no visibility into.

This is the part that should make non-Signal users pay attention. The same database stages notifications for every app on the device. Anything you've ever received as a push — from a banking alert to a 2FA code to a private DM — has at some point passed through this layer. iOS 26.4.2 doesn't retroactively scrub that history; it stops the leak going forward.

What you should do right now

Why it matters beyond Signal users

Three reasons this is a bigger story than the FBI-Signal headline:

• It's a category bug. Any app that delivers notifications was affected. Banking alerts, work email previews, MFA codes — all routed through the same staging path.
• Disappearing messages are a leaky abstraction. The feature is end-to-end secure on the wire, but iOS's notification stack is not part of the trust boundary. App-level disappearance does not mean OS-level disappearance.
• Forensic extraction is moving up the stack. Mobile forensics tooling (Cellebrite, GrayKey) has historically targeted app data; this case shows the OS-side notification database has become a primary target. Expect tooling and procedures to follow.

For a wider context on the OS-vs-app trust boundary problem, our state of cybersecurity 2026 piece tracks the same pattern across other vendors. And if you'd like to remove Google's Gemini from a parallel category of leakage on the AI side, we just shipped a 12-minute Gemini privacy walkthrough that covers the equivalent for Android.

What to watch next

• The CVE write-up. Apple's advisory is light. A full technical disclosure from a third-party researcher will reveal whether the residual data was plaintext or encrypted-at-rest.
• macOS coverage. macOS likely shares the notification-database substrate. Watch for an equivalent Sequoia / Sonoma patch within two weeks; if there isn't one, the bug was iOS-specific.
• Cellebrite advisories. The forensic-tools market will brief their law-enforcement customers on whether 26.4.2 closes existing extraction methods. That advisory will be public eventually.

The short version: this is an iOS bug that affected every messaging app, not a Signal bug. The fix is shipping. Update now and tighten your notification previews while you're in there.