Apple corrects a bug in iOS 26.4.2 that could leave traces of already deleted notifications

Apple has launched iOS 26.4.2 and iPadOS 26.4.2 with a security correction that, although on paper it seems small, touches on one of those points that are most uncomfortable when they come to light: the difference between deleting something and that something truly disappearing from the device.

The company has acknowledged in its official documentation that there was a problem where notifications marked for deletion could be unexpectedly retained on the device. Apple describes it as a registry problem and says it has been fixed with an improvement in data redaction.

A small correction in appearance, but delicate in privacy

The part that has triggered interest around this update is not so much in the technical name of the bug as in the context that surrounds it. In the last few hours this correction has been linked to a case in which the FBI would have managed to recover previews of Signal messages from the local iPhone notification database. Apple doesn’t mention the FBI in its official notice, nor does it go into detail about specific investigations, but the timing of the update and the exact nature of the bug have made for pretty obvious reading.

The important thing here is to understand what has actually been corrected. We are not talking about someone having broken Signal’s encryption or that the messages have been extracted from the application itself. The focus is on a previous and much more mundane layer: the notifications that the system saves to show incoming notices. If these entries are not deleted correctly when they should disappear, the problem is no longer in the messaging app, but in how iOS manages residual information that the user can consider deleted. This changes the reading of the case quite a bit, because it once again puts the emphasis on the operating system and not on the messaging platform.

Apple has limited the update to a very specific correction

Apple has identified this vulnerability as CVE-2026-28950. In its official document it indicates that it affects iPhone 11 and later, in addition to several generations of iPad Pro, iPad Air, iPad and iPad mini. The company released the safety information on April 22, 2026the same day that iOS 26.4.2 and iPadOS 26.4.2 versions appeared. For older devices, Apple also distributed iOS 18.7.8 and iPadOS 18.7.8 as part of the same round of patches.

That Apple only highlights one specific fix in this update also says a lot. We are not facing a version loaded with new functions or a major revision of the system. It is, rather, a surgical response to a particularly sensitive point of privacy. And that is usually the clearest sign that it is advisable to install it as soon as possible. When an intermediate update arrives without frills and with an explicit reference to a notification retention failure, the message is usually quite simple: here we do not have to wait to see if it brings battery improvements or visual changes, here it is time to close a door as soon as possible.

There’s also an interesting nuance in the way Apple explains the solution. The company talks about “improved data redaction”, that is, an improvement in deleting or masking recorded data. It is not describing a profound redesign of the notification system, but rather a correction aimed at preventing information marked to disappear from continuing to leave useful traces. In other words, the change does not seem intended to change how the user sees their notices, but rather to ensure that the system does not retain more than it should when those notices should no longer exist.

A discreet but important update

The episode once again demonstrates something that is repeated every time a case like this comes out: In terms of privacy, it is not enough to encrypt information well in transit or within an app. It also matters what the system does with metadata, caches, auxiliary databases and elements that the user neither sees nor manages directly. Many times, the most delicate thing is not in the complete message, but in a summary, a preview or a persistent notification that was forgotten where it should not have been. These types of remains are what end up making the difference between a solid security theory and real use exposed to much less comfortable nuances.

In a practical sense, the conclusion is simple: if you have a compatible iPhone, this is one of those updates that deserves to be installed without too much ado. Apple has not presented iOS 26.4.2 as a spectacular version, but as a necessary one. And at a time when the debate about private messaging, data retention and forensic access is once again very much alive, closing a bug that could preserve already deleted notifications is much more important than its technical name suggests.