iOS 26.4.2 closes FBI Signal security vulnerability Apfelpatient

The iOS 26.4.2 update released today fixes a critical security vulnerability: The FBI was able to extract deleted Signal messages from the iPhone's notification database – even after the app was uninstalled. Apple has closed the vulnerability, also for older systems.

The iOS 26.4.2 update released today has more significance than initially thought. What appeared to be a typical bug fix update actually contains a patch for a security vulnerability uncovered in a US court case. The FBI was able to extract deleted Signal messages from the iPhone's internal notification database for months – even after the app had been uninstalled.

This case is remarkable for several reasons. Signal is considered the most secure of all popular messaging apps, with end-to-end encryption and additional privacy features such as self-destructing messages. The fact that law enforcement still gained access wasn't due to weaknesses in Signal itself, but rather to a bug in iOS. The notification database stored message content longer than intended, making it forensically accessible.

How the gap works

The attack vector is technically interesting: When a user enables message previews on the lock screen, iOS internally stores the notification content for display. Normally, this data should be deleted after a short time. However, a flaw in the system caused the messages to remain – even after the original app (in this case, Signal) had long since been uninstalled.

In the specific court case, the accused had taken several protective measures:

Signal messages were set to self-destruct.
The Signal app had already been uninstalled from the iPhone.
The messages should have been gone long ago.

Nevertheless, the FBI was able to use forensic tools to read the notification database and find the message previews. According to Apple's statement, the company has fixed the logging problem with improved data redaction – meaning the messages are now truly deleted, as the system originally intended.

Older iOS versions will also receive the patch

An important feature of this update: Apple is delivering the security patch not only for iOS 26 and iPadOS 26, but also for iOS 18.7.8 and iPadOS 18.7.8. This means that users of older iPhones and iPads who have not installed, or cannot install, the iOS 26 update will also receive the protection.

This isn't a given. Apple typically only provides limited support for older iOS versions – but in this case, the company is demonstrating how seriously it takes the vulnerability. Anyone still using iOS 18 should also install the update as soon as possible.

iOS 26.4.2: What users should do now

The most important recommendation: Install the update immediately. Regardless of whether you use Signal or not, the vulnerability affected the fundamental iOS notification database, so theoretically other messaging apps as well. Any app that displays message previews on the lock screen could have been affected.

The installation process is as usual via Settings → General → Software update. The download size is approximately 500 MB to 1 GB, and the installation takes 10 to 20 minutes. During this time, the device cannot be used.

Additionally, users particularly concerned about data privacy should reconsider their message preview settings. Under Settings → Notifications, you can specify for each app whether and how message previews are displayed. Those who want maximum privacy should disable previews completely or only allow them to be displayed when the iPhone is unlocked.

The political context

This case raises broader questions. On the one hand, it demonstrates the high demands placed on secure messaging apps – even Signal, with all its privacy features, couldn't compensate for the vulnerability because it was at the operating system level. On the other hand, it shows that law enforcement agencies are increasingly using forensic methods that also target subtle iOS vulnerabilities.

Apple has repeatedly and demonstratively resisted requests from authorities in the past – for example, during the well-known FBI-iPhone dispute in 2016. In this current case, the company appears to be closing the vulnerability quietly and pragmatically, without public controversy. This is likely also related to the fact that the vulnerability is being documented for the first time and could therefore be exploited by criminal actors.

This incident is the latest in a series of Apple security updates over the past few months. The upcoming iOS 27 generation will bring stricter network security – another indication that Apple is increasingly focusing on security in the coming months.

The core message remains clear: Install the update immediately – the security vulnerability wasn't theoretical, but was actively exploited. (Image: Shutterstock / chaylek)