APPLE PATCHES BUG THAT LET COPS READ DELETED MESSAGES
INDUSTRY DESK■ 2 MIN READ
WED, APR 22, 2026■ AI-SUMMARIZED FROM 3 SOURCES BELOW
Apple has fixed a vulnerability in iOS and iPadOS that allowed law enforcement to recover deleted chat messages from Signal and other messaging apps using forensic tools.
The bug affected how iPhones and iPads handled deleted data from messaging applications. Forensic tools used by police could access messages that users believed they had permanently removed from Signal.
Apple addressed the vulnerability in recent security updates. The issue stemmed from how the operating system managed deleted data in application storage, leaving recoverable traces that law enforcement could extract with specialized forensic equipment.
Signal, the encrypted messaging app, had already deleted the messages from its own database. However, the underlying iOS vulnerability meant deleted data remained accessible at the system level, allowing forensic tools to reconstruct the content.
Law enforcement agencies have relied on similar forensic extraction methods for years to access data on seized devices. This particular vulnerability represented a gap between user expectations of deletion and actual data removal on Apple devices.
The fix ensures that deleted messages are more thoroughly scrubbed from device storage, making recovery significantly more difficult. Apple did not disclose the specific technical details of the vulnerability or name which iOS versions were affected, though the patch was rolled out through standard security updates.
This incident highlights the ongoing tension between device security, user privacy, and law enforcement access. While the fix benefits users concerned about data recovery from their devices, it also limits forensic capabilities that police rely on during criminal investigations.
Apple regularly patches security vulnerabilities discovered through both internal testing and external security researchers. The company has increasingly emphasized privacy features in its devices, though this often conflicts with law enforcement requests for access to user data.
■ MORE FROM THE SECURITY DESK
Artificial intelligence tools have enabled a surge in synthetic child sexual abuse material, forcing investigators to spend critical resources sorting fake images from real cases of endangered children.
JUST NOW— AI Desk
France's government agency responsible for issuing national IDs, passports, and related documents confirmed a data breach exposing citizens' personal information. The agency has not disclosed the number of affected individuals.
JUST NOW— Security Desk
Researchers at Fingerprint discovered a Firefox vulnerability that creates a persistent identifier linking separate Tor browser identities, undermining the privacy protections users expect from Tor.
1H AGO— Industry Desk
A new Mirai-based malware campaign is actively exploiting CVE-2025-29635, a high-severity command-injection vulnerability in D-Link DIR-823X routers. The end-of-life devices are being conscripted into the botnet at scale.
1H AGO— AI Desk