Cybersecurity — 2026-04-23

Apple patches iOS flaw that let FBI extract deleted Signal messages

Apple released iOS 26.4.2 patching a privacy flaw that enabled US law enforcement, specifically the FBI, per MacRumors via PrivacyGuides, to recover deleted Signal messages from iPhone devices. PrismNews reported Apple confirmed the fix applies to a recovery pathway that survived user-initiated deletions. The patch arrives amid reporting that the FBI investigated a New York Times reporter following coverage of FBI Director Kash Patel's girlfriend, an investigation NYT itself disclosed.

Analysis
The patch confirms FBI tooling had been capable of recovering deleted Signal messages at the iOS layer, content users believed permanently gone. The FBI-specific attribution rests on MacRumors via PrivacyGuides alone and may instead reflect Apple closing a researcher-reported flaw with no documented Bureau connection. The fix lands alongside NYT's disclosure that the Bureau investigated one of its reporters over coverage of FBI Director Patel's girlfriend, two data points suggesting Bureau targeting practices on journalists and encrypted communications are operating in parallel. The iOS-layer pathway is now closed for this flaw; state-level adversaries likely retain broader endpoint-compromise vectors against Signal and other E2E messengers.
3 sources
  1. iOS 26.4.2 Patches flaw that let FBI extract deleted signal messages - PrivacyGuides
  2. Apple fixes iPhone privacy flaw that left deleted messages recoverable - Prism News
  3. F.B.I. Said to Have Investigated Times Reporter After Article on Patels Girlfriend - The New York Times

View in full brief →

UNCLASSIFIED // OPEN SOURCE