(Credit: Justin Tallis/AFP via Getty Images)
An unexpected software update for iPhone and iPad arrived on Wednesday, fixing a bug that made private messages accessible even after they were deleted.
Apple’s security notice for the update, CVE-2026-28950, says it fixes an issue where “notifications marked for deletion could be unexpectedly retained on the device.”
The company didn’t explain why it’s pushing this change through an out-of-band security update, but it follows a 404 Media report that said the FBI had extracted deleted Signal messages from an iPhone, citing multiple people who were present during the FBI's testimony in a recent trial.
The case involved a Signal user who had deleted their messages and the app from their iPhone. But the FBI later recovered previews of incoming messages displayed on the phone's home screen from its push notifications database. It allowed the FBI to read selected portions of a conversation, but did not provide access to messages sent from the device.
In a statement on X, Signal said, “We are very happy that today Apple issued a patch and a security advisory.” It’s thought that Signal’s pressure on this issue pushed Apple to fix the problem, as CEO Meredith Whittaker previously said Signal requested the change.
“We’re grateful to Apple for the quick action here, and for understanding and acting on the stakes of this kind of issue," Signal added. "It takes an ecosystem to preserve the fundamental human right to private communication.”
You’ll get this update on your smartphone or tablet if you’re running the latest iOS 26.4.2 or iPadOS 26.4.2 software. Those on iOS 18.7.8 software will also get the change, but Apple hasn’t made any changes for devices with older software, so be aware if you're not up to date.