cyber.hendryadrian.com
Vulnerability & Exploit · securityweek.com

Apple Patches iOS Flaw That Retained Deleted Notification Previews

· Original article ↗

Summary

Apple patched CVE-2026-28950, a logging flaw that retained deleted notification previews. The FBI reportedly used it to recover Signal chats; Apple did not confirm exploitation in the wild.

Key points

  • CVE-2026-28950 allowed notifications marked for deletion to remain on iPhones and iPads.
  • Apple fixed the flaw in iOS and iPadOS 26.4.2 and 18.7.8 by improving data redaction.
  • The FBI reportedly used the notification issue to recover Signal chats that had been set to disappear, even after Signal was uninstalled.
  • Apple did not provide further vulnerability details or say the flaw was exploited in the wild.
  • Signal said installing the patch removes inadvertently retained notifications and prevents future notifications from being preserved for deleted apps.
  • Jamf noted that notification previews can expose sensitive work information, including two-factor codes, calendar invites, and customer alerts.

Article Details

Vulnerability Types
  • Logging issue causing notification content marked for deletion to remain in the device's system cache
Exploitation Status
reported
Exploit Availability
unknown
Patch Status
available

MITRE ATT&CK

T1005 · Data from Local SystemThe FBI reportedly recovered Signal message previews retained in the iPhone's system cache using forensic tools.

CVE

CVE-2026-28950Apple · iOS and iPadOS; Apple · iPadOSTracked as CVE-2026-28950, the bug is described as a logging issue resulting in notifications that have been marked for deletion to be retained on the device.

People

Adam BoyntonJamf senior enterprise strategy manager who commented on the vulnerability's impact on enterprise users.

Vendors

AppleApple on Wednesday announced fresh iOS and iPadOS updates that address a vulnerability allowing the recovery of deleted messages.JamfIn an emailed comment, Jamf senior enterprise strategy manager Adam Boynton underlined the impact the vulnerability has on enterprise users:

Products

iOSApple on Wednesday announced fresh iOS and iPadOS updates that address a vulnerability allowing the recovery of deleted messages.iPadOSApple on Wednesday announced fresh iOS and iPadOS updates that address a vulnerability allowing the recovery of deleted messages.SignalHowever, it appears that the vulnerability was exploited by law enforcement to extract Signal messages from the iPhone of an alleged Antifa member, a suspect in the Prairieland case.

Related Articles