Apple has released iOS 26.4.2 and iPadOS 26.4.2 (build 23E261), a minor update that arrives two weeks after iOS 26.4.1. The update patches a significant security vulnerability that the FBI recently exploited to extract Signal message previews from an iPhone, even after the app had been deleted.
The Security Fix: FBI, Signal, and iPhone Notifications
The vulnerability at the heart of this update involves iOS’s notification database. When an iPhone is set to show message content on the Lock Screen, incoming messages are stored in a system-level notification database that operates independently of any app. The problem was that this data was not being properly deleted when apps were removed or messages were set to disappear.
The issue came to light after court testimony in a federal trial revealed that the FBI had accessed Signal message previews from a defendant’s iPhone, even though the Signal app had been deleted and disappearing messages had been enabled. The notification database had retained the message content long enough for forensic tools to retrieve it.
Apple says it fixed the logging issue with improved data redaction. The fix means that when an app is deleted, its associated notification data is properly removed as well. Importantly, this only affected incoming messages as outgoing messages do not pass through the push notification system.
The same fix is included in iOS 18.7.8 and iPadOS 18.7.8 (build 22H352) for older devices that have not moved to iOS 26.
How to Update
Go to Settings, General, Software Update to download iOS 26.4.2 over the air. The update is available for iPhone 11 and later. Given the nature of the security fix, updating promptly is worthwhile, particularly for anyone who uses Signal or other encrypted messaging apps with Lock Screen previews enabled.
iOS 26.5 is currently in its third developer beta and second public beta, with a final release expected in May. That update lays the groundwork for end-to-end encrypted RCS messaging and ads in Apple Maps, though it is otherwise a minor release as Apple shifts attention toward iOS 27, set to be unveiled at WWDC on June 8.