iOS 26 erases key spyware detection logs

Researchers have discovered that Apple's latest iOS 26 update removes a key forensic artifact used to detect Pegasus and Predator spyware infections, raising major concerns among cybersecurity experts, according to Cybernews.

According to iVerify, a leading iPhone forensics firm, the update changes how the system handles the shutdown.log file, a log that once preserved traces of device compromise, by rewriting it after every reboot.

"This development poses a serious challenge for forensic investigators," said iVerify's VP of Research Matthias Frielingsdorf, warning that evidence of past spyware infections will now vanish upon restart. For years, the shutdown.log had served as an essential record for spotting Pegasus-related activity, even when attackers tried to erase it.

With iOS 26's automatic overwriting, users who update may unknowingly erase historical traces of compromise. iVerify cautioned that the timing is troubling, as "spyware attacks are becoming more common" and high-profile individuals continue to be targeted globally.