Apple’s latest update to iOS 26.4.2 and iPadOS 18.7.8 fixes a critical privacy bug: deleted notifications could still be retrieved or remain visible due to a logging issue linked to CVE-2026-28950.

Apple urges immediate installation of the update to protect security and performance, guiding users to Settings > General > Software Update; the patch targets iPhone 11 and later and compatible iPad models.

Early user feedback indicates improved keyboard responsiveness and potential battery life gains on certain devices after applying the update.

The issue highlights a broader OS-level risk: any app that renders message text in push alerts can leave traces beyond app-level encryption, raising privacy concerns for SMS, WhatsApp, and other messaging apps.

Users can harden privacy by setting notification previews to "When Unlocked" or "Never" under Settings > Notifications > Show Previews and by reviewing per-app notification content settings.

The risk and update were spotlighted in a YouTube explainer from iDeviceHelp, which also demonstrated the update process.

The update also addresses a broader logging vulnerability related to data redaction, affecting iPhone 11 and newer devices as well as several iPad models.

Apple notes the update is small in size (typically under 1GB) and may deliver performance tweaks like better keyboard responsiveness and longer battery life on some devices.

The CVE-2026-28950 vulnerability underscores the forensic reality that physical device access with a legal order can reveal low-level artifacts, prompting this patch.

Overall, iOS 26.4.2/iPadOS 18.7.8 is a critical security and performance update designed to close a high-severity privacy hole.

Public attention to the issue intensified after FBI testimony described investigators accessing Signal notification previews from a device even after deletion, prompting the out-of-band patch.

Signal welcomed the fix; once installed, inadvertently preserved notifications will be deleted, and users can further reduce exposure by setting Signal notification previews to no name or content.