Story perspectives

Apple patches iOS bug exploited for deleted Signal messages

4/26/2026

Summary

Apple Patches Vulnerability

Apple released iOS 26.4.2, iPadOS 26.4.2, iOS 18.7.8 and iPadOS 18.7.8 on April 24, 2026 to patch CVE-2026-28950 in Notification Services.
The FBI used the vulnerability in a Texas case to retrieve deleted Signal message previews from a suspect’s iPhone after the app was removed.
Signal confirmed the update resolves the issue and requires no further user action.
Cybersecurity experts advise users to limit notification details to protect privacy.

Summary

Apple Issues Patch

Apple released iOS 26.4.2, a security update supporting iPhone 11 and newer models—including iPhone SE 2/3, iPhone 17 series, iPhone Air—and providing patches via iOS 18.7.8 for XS, XS Max and XR.
The 772 MB download installs in under ten minutes on an iPhone 17 Pro Max, after which devices cannot be downgraded because the patch purges notification fragments.
Apple delivered the update over-the-air, with the rollout arriving only two weeks after iOS 26.4.1, showing a swift response to a vulnerability.

1 of 2

Apple Patches Vulnerability

Apple released iOS 26.4.2, iPadOS 26.4.2, iOS 18.7.8 and iPadOS 18.7.8 on April 24, 2026 to patch CVE-2026-28950 in Notification Services.
The FBI used the vulnerability in a Texas case to retrieve deleted Signal message previews from a suspect’s iPhone after the app was removed.
Signal confirmed the update resolves the issue and requires no further user action.
Cybersecurity experts advise users to limit notification details to protect privacy.

1 / 2