Your iPhone Kept Your Deleted Signal Messages. The FBI Found Them.

Smartphone screen glowing in a dark room — Photo via Unsplash

TL;DR: Apple patched CVE-2026-28950 on April 22, 2026. The bug: iOS kept copies of push notification content in an internal database, even after messages disappeared, even after you deleted the app entirely. The FBI used standard forensic tools to pull Signal messages from an iPhone in a federal investigation. The fix is in iOS 26.4.2 and iOS 18.7.8. Update now. Then go change your Signal notification settings to show zero message content.

What Happened

You deleted Signal from your iPhone. You thought the messages went with it. They didn't.

On April 22, Apple quietly released iOS 26.4.2 to fix a bug tracked as CVE-2026-28950, a "logging issue" in Notification Services that stored notification content longer than intended. Way longer. Apple's description was two sentences long: the flaw caused devices to "unexpectedly retain notifications marked for deletion." The fix: "improved data redaction" ^[1].

That sterile language hides what actually happened. Federal law enforcement recovered Signal message content from an iPhone using this flaw. Not by breaking Signal's encryption. Not by intercepting messages in transit. By reading the notification previews that iOS kept squirreled away in a system database after the user thought everything was gone ^[2].

The case involved the Prairieland ICE detention center facility. Investigators used standard forensic extraction tools, the same ones used in thousands of law enforcement investigations, to pull incoming Signal messages from the phone's notification storage ^[3].

How the Bug Worked

When you get a Signal message, your iPhone shows a notification. That notification contains message content, unless you've specifically turned previews off. iOS stores that notification in an internal database so it can display it in your notification center, on your lock screen, and in the app's notification history.

The bug: when those notifications were supposed to be deleted, whether because the message disappeared, you cleared notifications, or you removed the entire app, iOS didn't actually purge the content from its internal notification database. The entries were marked for deletion but never cleaned up ^[1][2].

This isn't a Signal problem. Signal's encryption worked exactly as designed. The message traveled end-to-end encrypted. The vulnerability is in what happened after iOS decrypted the notification to display it. Apple's system kept a copy that nobody knew about, not users, not Signal, not security researchers until the FBI case made it obvious ^[3].

Any app that sends push notifications with content could have been affected. Signal. WhatsApp. iMessage. Telegram. Every notification that ever crossed your lock screen potentially left a trace in this database.

The FBI Connection

Details about the specific federal investigation are limited, but here's what we know: agents had physical access to an unlocked iPhone connected to an investigation involving the Prairieland ICE detention facility. They used standard mobile forensic tools, the same commercial extraction software available to thousands of law enforcement agencies, to recover notification data ^[3].

The recovered data included incoming Signal message content. Messages that the user believed were private, encrypted, and deleted.

This is different from previous cases where law enforcement cracked phone encryption or compelled companies to hand over data. Nobody broke Signal's encryption. Nobody served Signal with a subpoena. The messages were just sitting there, in Apple's notification database, readable by anyone with device access and a forensic toolkit.

Why "Deleted" Doesn't Mean What You Think

This bug exposes a fundamental problem with how smartphones handle encrypted messaging. You can build the most secure messaging protocol in the world, and Signal's is widely regarded as the best, but it doesn't matter if the operating system underneath is keeping copies of your messages in plaintext.

The attack surface isn't the encryption. It's everything around the encryption:

Notification content: CVE-2026-28950. The bug Apple just patched.
iCloud backups: Unless you specifically disable iCloud backup for an app, your data may be copied to Apple's servers.
Keyboard caches: Predictive text learns from what you type, including in encrypted apps.
Screenshots and screen recordings: iOS doesn't prevent apps from screenshotting notification content.
Spotlight indexing: Search indexes can capture message snippets.

The Electronic Frontier Foundation called it directly: "App notification metadata remains largely opaque to users," noting that notification systems can leak sensitive information in ways people don't expect ^[4]. When you use an encrypted messenger, you're trusting not just the app developer, but every layer of the operating system that touches your messages.

Signal's Response

"We're grateful to Apple for the quick action here, and for understanding and acting on the stakes of this kind of issue," Signal said after the patch ^[2]. That's diplomatic language for: Apple's operating system was undermining our encryption, and they fixed it when we flagged it.

Signal confirmed that no user action is needed for the fix itself, the iOS update automatically cleans up the retained notification data and prevents future retention. But they also recommended something users should have been doing all along: change your notification settings to show less content.

What You Should Do

Update Your iPhone Immediately

Settings > General > Software Update. Install iOS 26.4.2 (or iOS 18.7.8 for older devices). The update patches the bug and cleans up any notification data that was incorrectly retained.

Change Signal Notification Settings

Open Signal > Settings > Notifications > Show. Change from "Name and Content" to "Name Only" or "No Name or Content." This prevents message text from ever reaching the notification system in the first place. This is the single most important thing you can do.

Do This for Every Encrypted App

WhatsApp, Telegram, Wire, any messaging app where you care about privacy. Go into each app's notification settings and disable message content previews. The less data your phone's notification system handles, the less there is to leak.

Consider Lockdown Mode

If you're a journalist, lawyer, activist, or anyone handling sensitive communications: Settings > Privacy & Security > Lockdown Mode. It restricts notification behavior and blocks several attack vectors. Yes, it limits features. That's the trade-off.

Affected Devices

Apple released patches for two iOS branches:

iOS 26.4.2 / iPadOS 26.4.2: iPhone 11 and later, iPad Pro 12.9-inch (3rd gen+), iPad Air (3rd gen+), iPad (8th gen+), iPad mini (5th gen+)
iOS 18.7.8 / iPadOS 18.7.8: iPhone XR through iPhone 16e, plus older iPad models still on iOS 18

If your device can run either of these updates, install the one available to you. If your device is too old for either patch, your notification database may still contain retained data, and there's no fix coming.

The Real Lesson

Encrypted messaging apps protect your messages in transit. They do not, and cannot, protect your messages from the operating system running underneath them. Your phone's OS sees everything. It displays notifications, manages storage, handles search indexing, and syncs to the cloud. Every one of those functions is a potential leak.

This bug wasn't a sophisticated state-sponsored exploit. It wasn't a million-dollar zero-day sold on the black market. It was a logging error. The kind of mundane software bug that probably exists in dozens of other places we haven't found yet.

The FBI didn't need to break encryption. They just needed Apple to have made a mistake. And Apple did.