Apple has fixed a security flaw that allowed law enforcement to access deleted Signal messages through an iPhone’s notification database.
The bug caused notifications marked for deletion to remain stored on the device, enabling the Federal Bureau of Investigation to retrieve readable message previews even after the app was removed.
“Apple's advisory confirmed that the bugs that allowed this to happen have been fixed in the latest iOS release,”
Signal said.
The issue was uncovered through court documents showing investigators extracted cached notification data despite Signal’s disappearing message feature being enabled.
Signal president Meredith Whittaker had previously urged Apple to address the flaw, warning that deleted message notifications should not persist in operating system databases.
The case highlights broader security risks at the device level, where encrypted messaging apps may still expose data through system-level storage or notification handling.
It also prompted commentary from Pavel Durov, who argued that disabling notification previews entirely may be necessary to ensure user privacy.