Apple Patches iOS Bug That Could Retain Deleted Notifications
Summary
Apple patched CVE-2026-28950 in iOS and iPadOS after deleted notifications could remain stored on devices. Reporting linked retained notification data to recovery of Signal messages, but Apple did not confirm exploitation or that connection.
Key points
- Apple issued out-of-band fixes for CVE-2026-28950 in iOS 26.4.2, iPadOS 26.4.2, iOS 18.7.8 and iPadOS 18.7.8.
- The Notification Services flaw could cause notifications marked for deletion to remain stored on the device.
- Apple said it addressed the issue with improved data redaction but provided no technical details or information about exploitation.
- Reporting described Signal messages recovered from an iPhone's notification storage after the app and messages had been deleted; Apple did not link its advisory to that case.
- Users are advised to install the updates. The article also recommends setting Signal notification content to “Name Only” or “No Name or Content”.
Article Details
- Vulnerability Types
- Notification data retention
- Exploitation Status
- unknown
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- In Signal, set Settings > Notifications > Notification content > Show to “Name Only” or “No Name or Content”.
CVE
Vendors
Products
iOSThe fixes—iOS 26.4.2, iPadOS 26.4.2, iOS 18.7.8 and iPadOS 18.7.8—use improved data redaction but Apple disclosed no technical details or whether the flaw was exploited, while reporting indicates retained notificationiPadOSThe fixes—iOS 26.4.2, iPadOS 26.4.2, iOS 18.7.8 and iPadOS 18.7.8—use improved data redaction but Apple disclosed no technical details or whether the flaw was exploited, while reporting indicates retained notificationSignalthe flaw was exploited, while reporting indicates retained notification data may have allowed recovery of Signal messages; users should install updates and consider changing Signal notification content to “Name Only”