Apple Patches iOS Flaw Allowing Recovery of Deleted Chats

Summary

Apple released iOS 26.4.2, iPadOS 26.4.2, iOS 18.7.8, and iPadOS 18.7.8 patches addressing CVE-2026-28950, a logging vulnerability that retained deleted message notifications in system cache. The flaw was reportedly exploited by law enforcement to extract Signal messages from an iPhone in the Prairieland case, despite the messages being set to disappear and the app uninstalled. Apple improved data redaction in the update, and Signal confirmed the patch automatically deletes inadvertently-preserved notifications.

Full text

Apple on Wednesday announced fresh iOS and iPadOS updates that address a vulnerability allowing the recovery of deleted messages. Tracked as CVE-2026-28950, the bug is described as a logging issue resulting in notifications that have been marked for deletion to be retained on the device. According to Apple, the newly released iOS 26.4.2, iPadOS 26.4.2, iOS 18.7.8, and iPadOS 18.7.8 platform refreshes address the flaw by improving data redaction. The security updates are available for dozens of iPhone and iPad models and generations, ranging from iPhone XR and iPhone XS to iPhone 16 and iPhone 16e, and from 5th generation iPad mini to iPad Pro 13-inch (M4). Apple did not share further details on CVE-2026-28950, nor did it mark the security defect as being exploited in the wild. However, it appears that the vulnerability was exploited by law enforcement to extract Signal messages from the iPhone of an alleged Antifa member, a suspect in the Prairieland case.Advertisement. Scroll to continue reading. The FBI reportedly exploited iOS’s notification issue to retrieve the Signal chats although they had been set to disappear and the messaging application was uninstalled from the device. The vulnerability resulted in previews of incoming messages to be saved to system cache, and they could later be scrapped using forensic tools. Shortly after Apple rolled out the fixes, Signal praised it for taking quick action to preserve users’ privacy. “Note that no action is needed for this fix to protect Signal users on iOS. Once you install the patch, all inadvertently-preserved notifications will be deleted and no forthcoming notifications will be preserved for deleted applications,” Signal said. Related: Oracle Patches 450 Vulnerabilities With April 2026 CPU Related: Progress Patches Multiple Vulnerabilities in MOVEit WAF, LoadMaster Related: Dozens of Malicious Crypto Apps Land in Apple App Store Related: Fortinet Rushes Emergency Fixes for Exploited Zero-Day Written By Ionut Arghire Ionut Arghire is an international correspondent for SecurityWeek. More from Ionut Arghire Oracle Patches 450 Vulnerabilities With April 2026 CPUDozens of Malicious Crypto Apps Land in Apple App StoreProgress Patches Multiple Vulnerabilities in MOVEit WAF, LoadMasterOrganizations Warned of Exploited Cisco, Kentico, Zimbra Vulnerabilities$290 Million Kelp DAO Crypto Heist Blamed on North KoreaBritish Scattered Spider Hacker Pleads Guilty in the USHackers Abuse QEMU for Defense EvasionHalf of the 6 Million Internet-Facing FTP Servers Lack Encryption Latest News Recent Microsoft Defender Vulnerability Exploited as Zero-DayAfter Bluesky, Mastodon Targeted in DDoS AttackMost Serious Cyberattacks Against the UK Now From Russia, Iran and China, Cyber Chief SaysNew Wiper Malware Targeted Venezuelan Energy Sector Prior to US Intervention Mirai Botnet Targets Flaw in Discontinued D-Link RoutersAre SBOMs Failing? Supply Chain Attacks Rise as Security Teams Struggle With SBOM DataClaude Mythos Finds 271 Firefox VulnerabilitiesNorth Korean Hackers Use AppleScript, ClickFix in Fresh macOS Attacks Trending Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Webinar: A Step-by-Step Approach to AI Governance April 28, 2026 With "Shadow AI" usage becoming prevalent in organizations, learn how to balance the need for rapid experimentation with the rigorous controls required for enterprise-grade deployment. Register Virtual Event: Threat Detection and Incident Response Summit May 20, 2026 Delve into big-picture strategies to reduce attack surfaces, improve patch management, conduct post-incident forensics, and tools and tricks needed in a modern organization. Register People on the MoveAnti-ransomware platform Halcyon has named Kirstjen Nielsen and Chris Inglis as Strategic Advisors.ThreatModeler has appointed Kevin Gallagher as Chief Executive Officer.Thomas Bain has been appointed Chief Marketing Officer at Silent Push.More People On The MoveExpert Insights Government Can’t Win the Cyber War Without the Private Sector Securing national resilience now depends on faster, deeper partnerships with the private sector. (Steve Durbin) The Hidden ROI of Visibility: Better Decisions, Better Behavior, Better Security Beyond monitoring and compliance, visibility acts as a powerful deterrent, shaping user behavior, improving collaboration, and enabling more accurate, data-driven security decisions. (Joshua Goldfarb) The New Rules of Engagement: Matching Agentic Attack Speed The cybersecurity response to AI-enabled nation-state threats cannot be incremental. It must be architectural. (Nadir Izrael) The Next Cybersecurity Crisis Isn’t Breaches—It’s Data You Can’t Trust Data integrity shouldn’t be seen only through the prism of a technical concern but also as a leadership issue. (Steve Durbin) Why Agentic AI Systems Need Better Governance – Lessons from OpenClaw Agentic AI platforms are shifting from passive recommendation tools to autonomous action-takers with real system access, (Etay Maor) Flipboard Reddit Whatsapp Whatsapp Email

Indicators of Compromise

• cve — CVE-2026-28950

Entities