The iOS 26.4.2, iPadOS 26.4.2, iOS 18.7.8, and iPadOS 18.7.8 updates that Apple released today address a security vulnerability that the FBI recently used to extract Signal message previews from an iPhone even after the app was deleted.
A flaw with notification services allowed notifications that were supposed to be deleted to be retained on an iPhone or iPad. Apple says it fixed the logging issue with improved data redaction.
Apple became aware of the vulnerability after recent court testimony revealed that the FBI was able to access the internal notification database on an iPhone involved in a case, providing law enforcement with access to message previews. The iPhone in question was set to display the content of Signal messages on the Lock Screen, and with that feature enabled, the iPhone stores message content.
The defendant in the case had deleted the Signal app and had Signal messages set to disappear, but the iPhone kept the messages in its database long enough for the FBI to access them.
