Apple fixes iOS bug that retained deleted notification data

Apple released out-of-band security updates (iOS/iPadOS 26.4.2 and 18.7.8) to fix CVE-2026-28950, a Notification Services flaw where notifications marked for deletion could be unexpectedly retained on devices; Apple says it fixed the issue via improved data redaction but gave few technical details. Independent reporting suggests the retained notification store was used to recover Signal message content from an iPhone even after the app was removed. Users are advised to install the updates and, for Signal users, limit notification content (e.g., set Show to "Name Only" or "No Name or Content") to reduce exposure.