At the center of the iOS update is a small but unsettling idea: messages that users believed were gone may have lingered inside the phone. Apple has released iOS 26. 4. 2 and iOS 18. 7. 8 with a warning to update now, because the fix addresses a security vulnerability that could expose notifications marked for deletion.
Apple has given limited detail, but it says the flaw affected Notification Services, where notifications marked for deletion could be unexpectedly retained on the device. The issue is tracked as CVE-2026-28950, and both Apple and Signal have now confirmed that the latest release closes it.
What did Apple fix in iOS?
The problem sits in the phone’s notification system, not in a user’s visible chat thread. Apple says the vulnerability could allow notifications marked for deletion to remain on the device. That matters because notification content can carry message text, and in some cases that text can outlive the app or the conversation the user thought had been removed.
This is why the company released two software updates at once: iOS 26. 4. 2 for newer devices and iOS 18. 7. 8 for users staying on the older operating system. The company did not spell out every technical detail, a standard move when it wants as many people as possible to install a patch before the weakness becomes better understood.
Signal confirmed that the fix addresses the issue in question. Apple’s action followed reporting that the FBI accessed Signal message notification content through iOS even after the app had been deleted. Signal added that once the patch is installed, inadvertently preserved notifications will be deleted and no forthcoming notifications will be preserved for deleted applications.
Why does a notification bug matter so much?
The significance goes beyond one app. Notifications are often treated as temporary, almost invisible, but they can become a storage layer for information people never expected to keep. Adam Boynton, senior enterprise strategy manager at Jamf, said Apple’s choice to ship a dedicated patch for a single issue and backport it to iOS 18 in the same release shows how seriously the company treats the integrity of its platform.
That concern is especially sharp in cases involving private communication. Signal said it was grateful for Apple’s quick action and said the episode shows that protecting private communication takes an ecosystem. The Electronic Frontier Foundation, however, said Apple’s fix only addressed part of the issue, pointing to broader concerns around how notification content can travel through services that deliver messages to phones.
Thorin Klosowski, a security and privacy activist with the Electronic Frontier Foundation, said push notifications typically route through Apple or Google servers first. He noted that the content may be visible to those companies and that metadata about which apps send notifications and when is also collected.
What should iPhone users do now?
Apple’s warning is direct: update now. The company has already tied the security fix to both iOS 26. 4. 2 and iOS 18. 7. 8, and Signal says no special action is needed beyond installing the patch. For users of Signal on iPhone, the update is meant to remove inadvertently preserved notifications and prevent new ones from being retained for deleted apps.
There is also a broader signal in Apple’s decision to offer iOS 18. 7. 8 on later-generation iPhones. It suggests the company is keeping older software available for people who want it, while still pushing critical security fixes across device generations. That approach mirrors earlier emergency updates Apple has issued when serious vulnerabilities surfaced.
For now, the practical answer is simple: the risk sits in the software layer most users never see, and the remedy is to install the update as soon as possible. In a system built on fleeting alerts, even a retained notification can turn into a lasting privacy problem.
Image alt text: Ios 26. 4. 2 update warning for iPhone users after a notification security fix
