Has Apple Fixed the IPhone Bug That Allowed the FBI to Recover Deleted Signal Messages?
Earlier this month , 404 Media published a gripping, complex, and disturbing story : the FBI successfully intercepted incoming Signal messages from a defendant’s iPhone, despite the fact that the famously secure messaging app had set them to self-destruct. While it’s easy to assume Signal was to blame, it turns out the problem was iOS—and Apple may have just patched it.
In short: 404 Media spoke with a person who attended the trial, where the court learned that all notifications from an iPhone are stored in a database on the device. Therefore, even though the Signal messages were deleted, the notification data remained in this database, from where the FBI was able to retrieve it. (The defendant’s own messages were not included, as notifications were generated only by incoming text messages.)
This story caused a stir in the tech community. Many of us who have used iPhones since their inception 20 years ago were surprised to learn about this “notification database,” sparking debate about the best way to improve notification security on iPhones. Based on information disclosed in the lawsuit, the best solution seemed to be blocking sensitive data from being displayed in notifications —if you prevent Signal from displaying message information in your notifications, an attacker who gained access to your notification database would only see that you received a notification from Signal, not what it said or who it was from. However, questions remained unanswered: do notifications persist in the database after they’re cleared? And if not, how long do they remain there?
iOS 26.4.2 may fix this issue with Signal.
While we don’t have definitive answers to these questions, we may be a little closer. On Wednesday, Apple released iOS 26.4.2. This update doesn’t include any new features or changes, so don’t expect your iPhone to look any different after installing it. In fact, the vague release notes only say that the update “provides bug fixes and security updates for your iPhone.” However, if you head toApple’s security update website , you’ll findthe official security notes for version 26.4.2 . Here, we see one bug fix for the notification service: “Notifications marked for deletion may unexpectedly persist on the device.”
There’s no easy way to confirm that this fix was released in response to the Signal news, but the timing is questionable, to say the least. What are the odds that just weeks after the FBI’s alleged access to a user’s “notification database” to recover deleted messages was revealed, Apple would release a fix for a bug that allowed deleted notifications to remain on the device? However, questions remain: Did the defendant in this case delete notifications from his iPhone, or just messages? Did notifications delete themselves after messages self-destructed? Incidentally,Apple also released iOS 18.7.8 , which fixes the same bug in notification services for older versions of iOS. I’ve contacted Apple for clarification and will update this article if I hear back.
How to install iOS 26.4.2
If this update does prevent attackers from receiving previously deleted notifications from our iPhones, we recommend installing it as soon as possible. To do so, go to Settings > General > Software Update , then follow the on-screen instructions to download and install the update. The same applies to installing iOS 18 version 18.7.8.