iOS 26.4.2 FBI Signal Fix: Does It Really Protect Your Deleted Messages? (CVE-2026-28950 Fully Explained)

Published: April 23, 2026  |  Last Updated: April 23, 2026

So you heard the headline: the FBI recovered deleted Signal messages from an iPhone — even after the app was completely deleted. Then Apple rushed out iOS 26.4.2 two weeks later. Now you’re wondering: is my iPhone actually safe now, or is this just another tech company saying “trust us”?

We dug into the Apple security bulletin, the original court testimony, the 404 Media report that broke the story, and Signal’s own public response. Here is a clear, no-nonsense breakdown of what the bug actually was, how the FBI used it, what Apple’s patch really does, and — most importantly — what you still need to do yourself even after updating.

Quick Answer: What Does iOS 26.4.2 Actually Fix?

iOS 26.4.2, released April 22, 2026, patches CVE-2026-28950. This was a flaw where deleted notifications — including Signal message previews — were silently staying saved inside a hidden system database on your iPhone, even after you deleted the app. Apple’s fix adds improved data redaction so that when a notification is marked for deletion, the content is actually, permanently erased from that database. The fix applies to iPhone 11 and later. If you are still on iOS 26.4.1 or earlier, your deleted notification previews are still recoverable by anyone with physical access to your phone and the right forensic tools.

iOS 26.4.1 vs iOS 26.4.2: Security Comparison at a Glance

One important thing nobody else is clearly saying: iOS 26.4.2 protects you going forward. But if your phone had the bug before you updated, old cached notification previews already stored in the database do not vanish the moment you install the patch. They persist until iOS gradually overwrites them over time. We will explain how to deal with that below.

The Real Story: How the FBI Actually Read Deleted Signal Messages

This whole situation came to light through courtroom testimony. Not a hack. Not a government leak. An FBI agent stood up in a federal trial and described exactly how they did it.

The case involved a defendant named Lynette Sharp, who was connected to an alleged attack on the ICE Prairieland Detention Facility in Alvarado, Texas. She had deleted Signal from her iPhone. She presumably thought that was the end of it. It was not.

FBI Special Agent Clark Wiethorn testified that investigators were able to forensically extract copies of incoming Signal messages from the defendant’s iPhone, even after the app had been deleted, because copies of the content had been saved in the device’s push notification database.

Here is the technical pipeline that made this possible, explained simply:

1. You receive a Signal message. It arrives encrypted. Signal decrypts it on your device. So far, the encryption is doing its job perfectly.
2. Signal creates a notification. If you have message previews turned on (which is the default setting most people never change), Signal hands the actual message text to iOS to show on your lock screen.
3. iOS stores the notification preview. The messages were sitting in the iPhone’s BulletinBoard framework — the system iOS uses to manage notifications — completely independent of the Signal app itself. This folder lives at /private/var/mobile/Library/BulletinBoard/ on the device.
4. You delete Signal. The app is gone. But those database entries in BulletinBoard? Still there.
5. Forensic tools pull the data. Forensic experts used tools such as Cellebrite to pull the data from the device’s push notification cache, where iOS stores content from messaging apps for lock screen previews. The database can retain this information for weeks, independent of Signal’s end-to-end encryption or self-destructing message timers.

This is the part that trips everyone up: Signal’s encryption was never broken. The FBI did not crack Signal. What they found was the decrypted text that had already been handled over to Apple’s own notification system. Once iOS had that text, it was Apple’s system storing it — and Apple’s system had a bug where it was not deleting it properly.

This means every messaging app with content previews is affected — WhatsApp, Telegram, iMessage, even email apps. Signal just got the headlines because it is the app people use specifically because they want privacy.

What Was CVE-2026-28950 Exactly? (Explained Simply)

The vulnerability, tracked as CVE-2026-28950, was found in Apple’s Notification Services framework. This component displays message previews when users receive notifications. Normally, when a notification is dismissed, the system is expected to delete any associated data immediately. However, due to a logging error, dismissed notifications were not fully erased. Instead, fragments of message content remained stored in local system logs. Over time, this created a hidden archive of previously received notifications, including potentially sensitive information from encrypted messaging platforms.

Think of it like this. Imagine you write a secret note on a whiteboard, take a photo of it, erase the whiteboard, and then throw away the original note. You think it is gone. But the photo is still sitting in a folder on the computer connected to the projector. That folder is the notification database. Deleting Signal is like erasing the whiteboard — it does not touch the photo.

Apple’s own description of the bug, from the official security bulletin, reads: “Notifications marked for deletion could be unexpectedly retained on the device.” Apple said the fix came through improved data redaction.

What iOS 26.4.2 Actually Changes Under the Hood

Apple addressed the root cause through improved data redaction in its logging framework. In plain English: when a notification is now marked for deletion in iOS 26.4.2, the system properly scrubs the content from its logs before the entry is written to the database. It does not just mark it as deleted and leave the data sitting there — the actual text gets wiped at the moment of redaction.

Improved data redaction is now applied at the logging level, preventing sensitive content from persisting in the first place.

This is a meaningful fix. It means future notifications will not accumulate in that hidden database. However — and this is the gap most coverage is skipping past — it does not retroactively erase notifications that were already stored before you updated.

If you have been running Signal with default notification settings, your notification database already contains cached message content. Changing the setting only prevents future messages from being stored. Old artifacts persist until they are overwritten by the system —which iOS does eventually, but there is no way to force it using standard settings. However, you can follow our technical guide on how to wipe iPhone notification databases to manually clear the KnowledgeC.db files.

What You Still Need to Do After Updating to iOS 26.4.2

Updating is step one. But if privacy is genuinely important to you, here is what our team recommends as the full checklist. In our testing on iOS 26 devices, we found that simply updating does not change your Signal notification settings — you have to do that part manually.

Step 1: Confirm You Are on iOS 26.4.2

Go to Settings → General → About. Check the iOS Version. It must say 26.4.2. If it says anything earlier, go to Settings → General → Software Update and install it now. The update is around 670–770 MB according to Apple.

Step 2: Turn Off Signal Notification Previews

To reduce exposure, users can disable message previews: In iOS Settings → Notifications → Show Previews, select “Never” for a global change or per app. Within Signal, go to Settings → Notifications and set “Notification Content” to “No Name or Content.”

Experts recommend both steps, as disabling previews at the system level prevents iOS from caching the content. One alone is not enough in all situations.

Step 3: Understand What Signal’s Disappearing Messages Do and Do NOT Do

This is something most guides miss completely. Signal’s disappearing messages delete content after a set time on the device and for recipients, but they do not erase cached notification previews if those were displayed before deletion. So even if you have disappearing messages turned on, if you had previews enabled, those previews are already in the BulletinBoard database and disappearing messages do nothing about them.

Step 4: For High-Risk Users — The Nuclear Option

For high-risk individuals: a full device wipe and restore — not from backup, which may include the notification database — is the nuclear option. Most people do not need to go that far. Just change the setting and move forward.

That said, if you have reason to believe you may be subject to investigation, or you handle professionally sensitive communications, wiping and setting up your device as new (not restoring from a backup) is the only guaranteed way to clear the existing notification cache.

Which iPhones and iPads Get the iOS 26.4.2 Patch?

The fix applies to: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later.

If you are on an older device that cannot run iOS 26, Apple has also released iOS 18.7.8 with the same CVE-2026-28950 fix. The iOS 26.4.2, iPadOS 26.4.2, iOS 18.7.8, and iPadOS 18.7.8 updates that Apple released on April 22 all address the same security vulnerability. So if you are still on iOS 18 for any reason, go to Settings → General → Software Update and look for iOS 18.7.8.

Is Signal Still Secure After All This?

Yes. And it is really important to understand why.

Signal’s end-to-end encryption was never the problem. Not once in this entire story was Signal’s protocol compromised, cracked, or even challenged. The FBI never broke Signal’s encryption. What they exploited was an Apple operating system bug that stored notification previews in an unprotected part of the filesystem.

Signal actually responded publicly and praised Apple for the quick response. Signal said in an X post: “We’re grateful to Apple for the quick action here, and for understanding and acting on the stakes of this kind of issue. It takes an ecosystem to preserve the fundamental human right to private communication.”

Signal’s settings include an option that prevents the actual message content from being previewed in notifications. The defendant in the Texas case did not appear to have had that setting enabled, which seemingly allowed the system to store the content in the database.

So the combination of iOS 26.4.2 + Signal with “No Name or Content” notifications enabled gives you the strongest protection possible right now. Signal CEO Meredith Whitaker had actually flagged this publicly even before Apple’s patch, pointing out that notifications for deleted messages should not remain in any OS notification database.

The Gap Nobody Is Clearly Explaining: “Before First Unlock” vs “After First Unlock”

This is one part of the story that almost every mainstream article has glossed over, and it matters for understanding the real scope of the risk.

When you look at how the FBI forensic extraction actually works, the state of your iPhone at the time of seizure matters a lot. With little to no technical details about the exact condition of the defendant’s iPhone, it is impossible to pinpoint the precise method the FBI used to recover the information. There are multiple system states an iPhone can be in, each with its own security and data access constraints, such as BFU (Before First Unlock) and AFU (After First Unlock) mode. Security and data access also change even more dramatically when the device is unlocked.

What this means practically:

• BFU (Before First Unlock): The iPhone has just been restarted and no one has entered the passcode yet. Forensic access is very limited. Most of the filesystem is encrypted.
• AFU (After First Unlock): The phone has been unlocked at least once since the last restart. Most apps and databases are accessible to forensic tools, including the notification database. This is the state most people’s phones are in almost all of the time.

The practical implication is that if you restart your iPhone frequently and keep it in BFU state, forensic tools have a much harder job even before iOS 26.4.2. After the patch, this distinction matters less for future notifications, but old cached data from before the patch is still there in AFU-accessible storage.

Does This Affect WhatsApp, Telegram, and Other Messaging Apps Too?

Yes. This is another thing most coverage is not being direct about. The iOS notification database bug is at the operating system level, not the Signal app level. Any app that sends message previews to your lock screen was potentially storing those previews in the same BulletinBoard database.

Signal got the attention because privacy-conscious users choose it specifically to avoid this kind of exposure. But if you use WhatsApp with message previews on, Telegram with message previews on, or even your regular email app, those notifications were going into the same database. If you’re concerned about your overall privacy on Meta’s platform, you should also check our guide on how to hide WhatsApp status previews to further secure your chat interface.

iOS 26.4.2 fixes this for all apps, not just Signal. But again — future notifications only. Whatever is already in the cache from before you updated is still sitting there.

Frequently Asked Questions

Can the FBI still recover deleted Signal messages after iOS 26.4.2?

For messages received after you updated to iOS 26.4.2, no — the fix prevents notification previews from persisting in the database. For messages that were received and cached before you updated, those old entries still exist until iOS overwrites them over time. If you need to clear them immediately, a full device wipe and setup as new (not from backup) is the only guaranteed method.

Does iOS 26.4.2 fix the problem for iPhone 10 or older?

No. iPhone 10 and older do not support iOS 26. If your device can run iOS 18, you should update to iOS 18.7.8, which contains the same CVE-2026-28950 patch. iPhone X (10), XS, and XR can all run iOS 18.7.8.

Did Signal do anything wrong here?

Not really. Signal had already provided a setting to disable message previews in notifications. The issue was that the default setting shows previews, and most users never changed it. The deeper problem was Apple’s notification system not properly deleting data after dismissal — that is an Apple-level bug, not a Signal bug.

Does this mean my iMessages and regular texts were also stored this way?

iMessage has the same exposure in theory, but iMessages are already deeply integrated with iOS and are accessible through other forensic pathways anyway. The bigger surprise was that this applied to Signal, which users specifically chose because they wanted to avoid data being stored anywhere on the OS level.

What is the “Show Previews: Never” setting actually doing?

When you set this to Never in Settings → Notifications → Show Previews, iOS does not pass the message text to the BulletinBoard framework at all. It only stores a generic “New Message” entry. If a forensic tool extracts your notification database, all it sees is “New Message” with a timestamp — not the actual content. This setting, combined with iOS 26.4.2, is your strongest protection.

Should I use Signal’s “Note to Self” feature to clear old messages?

Deleting messages inside Signal does not affect the BulletinBoard database. Signal can only control its own app storage, not iOS system-level databases. Clearing messages in the Signal app does not remove the notification previews already cached by iOS.

Will iOS 26.4.3 do anything more about this?

Apple has not announced any further updates specifically related to CVE-2026-28950. The current patch in 26.4.2 is Apple’s stated complete fix. Future iOS updates will be routine unless new vulnerabilities are discovered.

Watch: iOS 26.4.2 FBI Notification Bug Explained

Here is a useful video overview of how push notification forensics work on iOS and what this update changes:

Your Complete Action Checklist Right Now

1. Update to iOS 26.4.2 immediately. Settings → General → Software Update. If you are on iOS 18, update to iOS 18.7.8 instead.
2. Disable notification previews system-wide. Settings → Notifications → Show Previews → Never.
3. Disable Signal notification content. Inside the Signal app: Settings → Notifications → Notification Content → No Name or Content.
4. Check your Signal app version. Open the App Store, tap your profile picture, and scroll down to check if Signal has a pending update. Make sure you are on the latest version.
5. If you need maximum privacy going back: Wipe your device and set it up as new. Do not restore from iCloud or local backup — backups may contain the notification database with old cached content.
6. Consider iCloud Advanced Data Protection if you use iCloud backups. Go to Settings → [Your Name] → iCloud → Advanced Data Protection. This encrypts more of your iCloud backup data end-to-end.

The Bottom Line

iOS 26.4.2 is a genuine, meaningful fix. Apple responded quickly — within two weeks of the 404 Media report — and the patch addresses the root cause at the logging level. For anyone using Signal, WhatsApp, or any messaging app with notification previews enabled, this update matters.

But the update alone is not the full answer. The fix only covers future notifications. Changing your notification settings to hide message previews is what actually stops the data from entering the vulnerable database in the first place. Think of iOS 26.4.2 as fixing the leaky pipe. Turning off notification previews is putting a bucket under the drip as a backup.

Do both. Do them today.

References and Sources

• Apple Security Content of iOS 26.4.2 and iPadOS 26.4.2 — Apple Support (Official)
• FBI Extracts Suspect’s Deleted Signal Messages Saved in iPhone Notification Database — 404 Media
• Apple Fixes iOS Bug That Retained Deleted Notification Data — BleepingComputer
• iOS 26.4.2 Patches Flaw That Let FBI Extract Deleted Signal Messages — MacRumors
• FBI Used iPhone Notification Data to Retrieve Deleted Signal Messages — 9to5Mac
• Apple Patches iOS Flaw That Stored Deleted Signal Notifications in FBI Forensic Case — The Hacker News
• Apple Fixes Notification Privacy Flaw That Allowed FBI to Access Deleted Signal Messages — Cyber Security News
• iOS 26.4.2 and iOS 18.7.8 Address Notification Privacy Flaw — TidBITS
• Deleting Signal Wasn’t Enough. The FBI Read the Messages Anyway — State of Surveillance
• FBI Recovers Deleted Signal Messages from iPhone Notification Database — Lynnwood Times