Earlier this month, 404 Media broke a fascinating, complex, and concerning story: The FBI had successfully retrieved incoming Signal messages from a defendant’s iPhone, despite the fact that those messages were set to self-destruct within the famously secure chat app. Though it’s easy to assume Signal would be to blame, it turns out the fault was with iOS—and Apple may have just fixed the problem.
To recap: 404 Media spoke to someone who attended the trial in question, where the court learned that all iPhone notifications are stored in a database on the device. So even though the Signal messages were deleted, their notification data remained in this database, from where the FBI was able to obtain them. (The defendant’s own messages weren’t present, since only incoming texts would generate notifications.)
The story generated buzz across the tech community. Many of us who have used iPhones since their inception 20 years ago were surprised to learn about this “notification database,” a revelation that prompted discussions of the best way to shore up iPhone notification security. Based on the information revealed in the court case, the best course of action seemed to be to block sensitive data from showing up in notifications—if you stop Signal from revealing message info in its alerts, then an intruder accessing your notification database would only see you received a Signal notification, and not what the message said or who it was from. Still, there were unanswered questions: Do notifications remain in the database after you clear them? And if you don’t, how long do they stay there?
iOS 26.4.2 might offer a fix for this Signal issue
While we don’t exactly have answers to those questions, we’re perhaps a bit closer to them. On Wednesday, Apple dropped iOS 26.4.2. This update doesn’t include any new features or changes, so don’t expect your iPhone to look any different after you install it. In fact, the vague release notes only offer that the update “provides bug fixes and security updates for your iPhone.” However, click through to Apple’s security releases site, and you’ll find the official security notes for 26.4.2. Here, we can see one bug fix for Notification Services: “Notifications marked for deletion could be unexpectedly retained on the device.”
What do you think so far?
There’s no easy way to confirm that this fix was issued in response to the Signal news, but the timing is curious, to say the least. What are the chances that, just weeks after the disclosure that the FBI had accessed a user’s “notification database” to retrieve deleted messages, Apple would issue a fix for a bug that left deleted notifications somewhere on the device? Even still, there are lingering questions: Did the defendant in the case delete the notifications from their iPhone, or just the messages? Did the notifications appear to clear on their own after the messages self-destructed? For what it’s worth, Apple also released iOS 18.7.8, which fixes the same Notification Services bug for the older build of iOS. I’ve reached out to Apple for clarification and will update this piece if I hear back.
How to install iOS 26.4.2
If this update does indeed prevent actors from obtaining previously deleted notifications from our iPhones, it’s a good idea to install it ASAP. To do so, head to Settings > General > Software Update, then follow the on-screen instructions to download and install the update. The same applies if you’re on iOS 18 trying to install iOS 18.7.8.
