Came out Wed April 22. Although we might not see a subsequent 26.4.2 for MacOS or whatever, because its security content only includes CVE-2026-28950, which has to do with Notifications marked for deletions being unexpectedly retained on a device.
To make a long story short, the FBI was able to retrieve deleted Signal messages from a confiscated iPhone. The owner of the phone was in a group accused of vandalizing an ICE detention facility, who had deleted the Signal app from his iPhone prior to being apprehended and getting her iPhone confiscated.
Deleting Signal should have deleted all the app’s messages, including those included in notifications.
But FBI found and was able to recover her Signal messages because the iPhone kept a cache of recent Notifications which included the Signal messages. Deleting didn’t clear those logged notifications. Signal has a somewhat obscure setting that disables message content in notifications, but the owner hadn’t turned that setting on.
The content of the Signal messages that the FBI found was used as evidence in her trial, in which she ended up pleading guilty to providing material support to terrorists.