Apple fixes iPhone and iPad flaw that retained deleted notification data
Apple released out-of-band updates for iOS 26.4.2, iPadOS 26.4.2, iOS 18.7.8, and iPadOS 18.7.8 to fix CVE-2026-28950, a privacy flaw in Notification Services that could cause notifications marked for deletion to remain stored on affected iPhones and iPads. Apple said the issue was caused by a logging problem and was resolved through improved data redaction, affecting supported devices across both current and older OS branches.
Apple did not say whether the bug had been exploited or why the fix was issued outside the normal release cycle, but government guidance from the Canadian Centre for Cyber Security urged users and administrators to apply the updates. Reporting on the patch noted similarities to a recent case in which investigators reportedly recovered Signal message content from an iPhone's internal notification storage after the app had been deleted, though Apple has not publicly connected the update to that incident.
Get ahead of threats like this
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
How this story unfolded
4 events from the most recent confirmed update back to the earliest known activity.
Signal confirms CVE-2026-28950 was tied to FBI-accessed Signal notifications
On 2026-04-23, Signal confirmed that CVE-2026-28950 was the same Apple Notification Services flaw implicated in reporting that the FBI accessed retained Signal notification content from a suspect's iPhone after the app had been deleted. Signal also said the Apple patch removes inadvertently preserved notifications and advised users to limit notification preview content to reduce exposure.
Canadian Centre for Cyber Security urges users to apply Apple updates
Later on April 22, 2026, the Canadian Centre for Cyber Security issued advisory AV26-381 referencing Apple's iOS and iPadOS security updates. It advised users and administrators to review Apple's documentation and install the necessary updates for affected devices.
Apple publishes security advisories detailing the notification retention flaw
Apple published security notices for the affected iPhone and iPad releases, documenting CVE-2026-28950 and the impacted supported models. The advisories noted Apple's standard practice of withholding security issue details until investigations are complete and fixes are available.
Apple releases iOS and iPadOS updates for CVE-2026-28950
On April 22, 2026, Apple released iOS 26.4.2, iPadOS 26.4.2, iOS 18.7.8, and iPadOS 18.7.8 to fix CVE-2026-28950, a Notification Services privacy flaw that could cause notifications marked for deletion to be unexpectedly retained on the device. Apple said the issue was caused by a logging problem and was addressed through improved data redaction.
Related entities
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Sources
17 references tracked. Mallory keeps watching after this page renders.
Apple patches bug that exposed deleted Signal messages - Boing Boing
boingboing.net
Open sourceA week in security (April 20 - April 26) | Malwarebytes
malwarebytes.com
Open sourceApple corrige la faille qui a permis au FBI de lire des messages ...
zdnet.fr
Open sourceApple stops weirdly storing data that let cops spy on Signal chats - Ars Technica
arstechnica.com
Open sourceAbout the security content of iOS 26.4.2 and iPadOS 26.4.2 - Apple Support
support.apple.com
Open sourceApple fixes iOS bug that retained deleted notification data
bleepingcomputer.com
Open sourceFull Disclosure: APPLE-SA-04-22-2026-2 iOS 18.7.8 and iPadOS 18.7.8
seclists.org
Open sourceFull Disclosure: APPLE-SA-04-22-2026-1 iOS 26.4.2 and iPadOS 26.4.2
seclists.org
Open sourceSee the full picture, correlated to your attack surface.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Related stories
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apple Fixes Safari WebKit Flaws and Notification Retention Privacy Bug
Apple released **Safari 26.5** for macOS Sonoma and macOS Sequoia to fix multiple vulnerabilities in **WebKit** and **WebRTC** that could be triggered by malicious web content. The flaws could allow **Content Security Policy bypass**, disclosure of sensitive user information, access to sensitive user data, misuse of another website’s download settings through a malicious iframe, and application or process crashes. Apple attributed the issues to validation, access control, UI handling, memory handling, and use-after-free weaknesses, and credited a broad set of external researchers and organizations for the findings. Apple also shipped updates for older devices—**iOS 16.7.16**, **iPadOS 16.7.16**, **iPadOS 17.7.11**, and **iOS/iPadOS 15.8.8**—to address **`CVE-2026-28950`** in Notification Services. The bug could cause notifications marked for deletion to remain on a device because of a logging issue, creating a privacy and data-handling risk; Apple said it resolved the problem through improved data redaction. Canada’s Cyber Centre urged users and administrators to review Apple’s advisories and apply the updates, including upgrading Safari systems to **26.5 or later**.
Jun 29, 2026
Apple Security Updates Address Multiple Vulnerabilities Including an In-the-Wild Exploited Memory Corruption Flaw
Apple issued security updates across its ecosystem to address **multiple vulnerabilities** affecting *iOS, iPadOS, macOS, tvOS, watchOS,* and *visionOS*, with impacts including **remote code execution (RCE)**, denial of service, elevation of privilege, information disclosure, data manipulation, and security restriction bypass. HKCERT highlighted **CVE-2026-20700** as a **high-risk** issue and noted it is **being exploited in the wild**; the flaw is described as an **improper restriction of operations within the bounds of a memory buffer** that could allow arbitrary code execution when an attacker has memory-write capability. Apple’s iOS 26.3 and iPadOS 26.3 security content includes fixes for issues that could expose sensitive information on a locked device (e.g., **CVE-2026-20645** and **CVE-2026-20674**) and a Bluetooth-related denial-of-service condition where a privileged network attacker could trigger DoS using crafted packets (**CVE-2026-20650**). The updates apply to **iPhone 11 and later** and a range of supported iPad models, and Apple reiterated its policy of publishing details after patches are available.
Jun 29, 2026
Apple iOS/iPadOS Security Updates and CVE Fixes Across Multiple Releases
Apple published security advisories detailing vulnerability fixes across multiple iOS and iPadOS versions, including iOS/iPadOS **16.7**, **17.2**, **18.1**, **18.3**, **26.1**, and **26.2**. The advisories describe a range of impacts such as sandbox escapes (including Web Content sandbox breakout), privacy issues where apps could access or expose sensitive user data via insufficient log redaction, file-system modification via temporary-file handling, and memory-safety flaws (e.g., out-of-bounds reads, type confusion, and bounds-checking issues) that could lead to crashes or memory corruption. Apple attributes fixes to changes like improved protocol handling, cache handling, input validation, and additional permission restrictions, and references issues by **CVE** where available. Several advisories also highlight device-state and authentication/logic weaknesses: iOS/iPadOS 18.3 includes a case where an attacker with physical access to an **unlocked** device could access Photos while the app is locked (`CVE-2025-24141`), while iOS/iPadOS 18.1 includes a lock-screen exposure issue (`CVE-2024-44274`) and a Shortcuts-related path-handling flaw that could allow arbitrary shortcut execution without user consent (`CVE-2024-44255`). The iOS/iPadOS 26.x advisories include privacy and permission issues (e.g., identifying installed apps, screenshots of sensitive embedded views), potential kernel memory corruption/system termination conditions, and logic/UI issues affecting security posture (e.g., passcode requirement timing after Face ID enrollment restore scenarios and potential FaceTime caller ID spoofing), with multiple findings credited to external researchers and teams (including Google Project Zero, ByteDance IES Red Team, and others).
Jun 29, 2026