Loading story…
Apple released out-of-band updates for iOS 26.4.2, iPadOS 26.4.2, iOS 18.7.8, and iPadOS 18.7.8 to fix CVE-2026-28950, a privacy flaw in Notification Services that could cause notifications marked for deletion to remain stored on affected iPhones and iPads. Apple said the issue was caused by a logging problem and was resolved through improved data redaction, affecting supported devices across both current and older OS branches.
Apple did not say whether the bug had been exploited or why the fix was issued outside the normal release cycle, but government guidance from the Canadian Centre for Cyber Security urged users and administrators to apply the updates. Reporting on the patch noted similarities to a recent case in which investigators reportedly recovered Signal message content from an iPhone's internal notification storage after the app had been deleted, though Apple has not publicly connected the update to that incident.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
On 2026-04-23, Signal confirmed that CVE-2026-28950 was the same Apple Notification Services flaw implicated in reporting that the FBI accessed retained Signal notification content from a suspect's iPhone after the app had been deleted. Signal also said the Apple patch removes inadvertently preserved notifications and advised users to limit notification preview content to reduce exposure.
Later on April 22, 2026, the Canadian Centre for Cyber Security issued advisory AV26-381 referencing Apple's iOS and iPadOS security updates. It advised users and administrators to review Apple's documentation and install the necessary updates for affected devices.
Apple published security notices for the affected iPhone and iPad releases, documenting CVE-2026-28950 and the impacted supported models. The advisories noted Apple's standard practice of withholding security issue details until investigations are complete and fixes are available.
On April 22, 2026, Apple released iOS 26.4.2, iPadOS 26.4.2, iOS 18.7.8, and iPadOS 18.7.8 to fix CVE-2026-28950, a Notification Services privacy flaw that could cause notifications marked for deletion to be unexpectedly retained on the device. Apple said the issue was caused by a logging problem and was addressed through improved data redaction.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
17 references tracked. Mallory keeps watching after this page renders.
boingboing.net
Open sourcemalwarebytes.com
Open sourcezdnet.fr
Open sourcearstechnica.com
Open sourcesupport.apple.com
Open sourcebleepingcomputer.com
Open sourceseclists.org
Open sourceseclists.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apple released **Safari 26.5** for macOS Sonoma and macOS Sequoia to fix multiple vulnerabilities in **WebKit** and **WebRTC** that could be triggered by malicious web content. The flaws could allow **Content Security Policy bypass**, disclosure of sensitive user information, access to sensitive user data, misuse of another website’s download settings through a malicious iframe, and application or process crashes. Apple attributed the issues to validation, access control, UI handling, memory handling, and use-after-free weaknesses, and credited a broad set of external researchers and organizations for the findings. Apple also shipped updates for older devices—**iOS 16.7.16**, **iPadOS 16.7.16**, **iPadOS 17.7.11**, and **iOS/iPadOS 15.8.8**—to address **`CVE-2026-28950`** in Notification Services. The bug could cause notifications marked for deletion to remain on a device because of a logging issue, creating a privacy and data-handling risk; Apple said it resolved the problem through improved data redaction. Canada’s Cyber Centre urged users and administrators to review Apple’s advisories and apply the updates, including upgrading Safari systems to **26.5 or later**.
Jun 29, 2026
Apple disclosed multiple security fixes for supported iPhone and iPad devices, including `CVE-2025-24200`, which allowed a physical attacker to disable USB Restricted Mode on a locked device, and `CVE-2025-43200`, a logic flaw triggered by malicious photo or video content shared through an iCloud Link. Apple said both vulnerabilities may have been exploited in extremely sophisticated attacks against specific targeted individuals, and credited Citizen Lab researcher Bill Marczak for reporting the USB Restricted Mode issue. Further reporting tied `CVE-2025-43200` to a zero-click Messages exploitation chain used to install Paragon's **Graphite** spyware on the phones of several journalists in Europe. Apple urged users to update affected platforms, while a separate later advisory for `iOS 26.0.1` and `iPadOS 26.0.1` fixed `CVE-2025-43400`, an out-of-bounds write in font processing that could cause app crashes or memory corruption on supported iPhone and iPad models.
Jul 24, 2026
Apple issued security updates across its ecosystem to address **multiple vulnerabilities** affecting *iOS, iPadOS, macOS, tvOS, watchOS,* and *visionOS*, with impacts including **remote code execution (RCE)**, denial of service, elevation of privilege, information disclosure, data manipulation, and security restriction bypass. HKCERT highlighted **CVE-2026-20700** as a **high-risk** issue and noted it is **being exploited in the wild**; the flaw is described as an **improper restriction of operations within the bounds of a memory buffer** that could allow arbitrary code execution when an attacker has memory-write capability. Apple’s iOS 26.3 and iPadOS 26.3 security content includes fixes for issues that could expose sensitive information on a locked device (e.g., **CVE-2026-20645** and **CVE-2026-20674**) and a Bluetooth-related denial-of-service condition where a privileged network attacker could trigger DoS using crafted packets (**CVE-2026-20650**). The updates apply to **iPhone 11 and later** and a range of supported iPad models, and Apple reiterated its policy of publishing details after patches are available.
Jul 23, 2026