Apple has released iOS 26.4.2 and iPadOS 26.4.2, a minor update focused entirely on bug fixes and security improvements for iPhone and iPad users. The update arrives two weeks after iOS 26.4.1 and iPadOS 26.4.1, continuing Apple’s steady cadence of incremental stability releases for iOS 26.
The update is available for supported devices over the air by going to Settings, then General, then Software Update. Alongside iOS 26.4.2, Apple also released iOS 18.7.8 for older iPhones that are not yet running iOS 26, ensuring the same security fix is applied across both current and legacy systems.
While Apple’s release notes initially describe the update in broad terms as containing bug fixes and security updates, the company’s security documentation provides more detail. The update addresses a vulnerability in Notification Services where notifications marked for deletion could be unexpectedly retained on the device.
At the core of the fix is a logging issue tied to how iOS handles notification data internally. Apple says the problem was resolved through improved data redaction, which prevents deleted notification content from being stored or left accessible on the device after removal. The vulnerability is tracked as CVE-2026-28950.
The issue affects a wide range of devices, including iPhone 11 and later models, as well as multiple generations of iPad Pro, iPad Air, iPad mini, and standard iPad models. Apple confirmed the same fix is included across both iOS 26.4.2 and iOS 18.7.8, keeping security coverage consistent across supported hardware.
This type of patch highlights a less visible part of iOS security. Notifications are not just temporary UI elements. They are processed through system services that can temporarily store content for display on the Lock Screen. When that pipeline does not fully clear deleted entries, residual data can remain on-device longer than intended.
Apple has already moved on to the next cycle of updates, with iOS 26.5 and iPadOS 26.5 currently in beta testing and expected to arrive later in May. For now, iOS 26.4.2 is a maintenance release that quietly closes a specific data retention issue while reinforcing how iOS handles sensitive notification data in the background.
