Apple has released iOS 26.4.2 and iOS 18.7.8, warning iPhone users to update now after fixing a single security flaw in Notification Services that could leave deleted alerts on the device. The bug is tracked as CVE-2026-28950, and it appears to be the same vulnerability the FBI used to extract copies of incoming Signal messages from a defendant’s iPhone.
The flaw matters because the content was saved in the push notification database, which meant message previews could survive even after the app was removed. Signal said today that Apple issued a patch and a security advisory, and said the FBI accessed Signal message notification content via iOS despite the app being deleted. Signal added that once the patch is installed, all inadvertently-preserved notifications will be deleted and no forthcoming notifications will be preserved for deleted applications.
Apple’s fix arrives a month after it released iOS 26.4, when it also included the ability to update to iOS 18.7.7 even on newer devices. The company has now gone further by releasing iOS 18.7.8 for later generations of the iPhone, while also backporting the same fix to iOS 18 for users who want to stay on the older operating system.
The patch lands with little public detail from Apple before users upgrade, which leaves outside researchers to connect the dots. The issue was first reported by 404 Media, and Bleeping Computer said Apple’s description of notifications being retained closely aligns with the type of data persistence described in that report. Signal, which confirmed that iOS 26.4.2 and iOS 18.7.8 fix the issue, framed the response as part of a broader fight over private communication and said it was grateful to Apple for the quick action.
Adam Boynton said Apple shipping a dedicated patch for a single issue and backporting it to iOS 18 in the same release shows exactly how seriously the company takes the integrity of its platform. For iPhone users, the message from Apple is blunt: install the update now, because the problem it closes was not abstract, and it was already being used.