Loading story…
Magnet Forensics sued former contractor Mario Del Gaudio and competitor Paradigm Shift Technology S.L. in federal court in Georgia, alleging they misappropriated trade secrets tied to an iOS zero-day affecting Apple A12 and A13 chips. According to the complaint, Del Gaudio worked on the vulnerability while under contract with Magnet and later researched the same flaw for Paradigm Shift after leaving. Paradigm Shift subsequently published research on the issue, then removed the post after the lawsuit was filed.
The disputed vulnerability is described as a boot ROM flaw affecting devices including the iPhone XS and iPhone 11 families, making it effectively unpatchable through normal iOS software updates. Magnet argues the public disclosure destroyed part of the exploit's commercial value for government surveillance and forensic customers and caused ongoing damage, turning the case into a high-profile dispute over ownership and disclosure of offensive mobile exploitation research.
Get the actors, campaigns, and ATT&CK mapping behind it.
3 events from the most recent confirmed update back to the earliest known activity.
After Magnet Forensics sued, Paradigm Shift removed its blog post describing the A12/A13 boot ROM vulnerability. The removal is reported as a response following the legal action, but no specific date is given.
In June 2026, Paradigm Shift Technology S.L. allegedly published research about an iOS zero-day affecting Apple A12 and A13 chips, making the vulnerability public. Magnet Forensics claims this disclosure reduced the exploit's commercial value and could enable Apple to patch it.
On 2026-07-07, Magnet Forensics filed a lawsuit in the U.S. District Court for the Northern District of Georgia against former contractor Mario Del Gaudio and Paradigm Shift Technology S.L. The complaint alleges misappropriation of trade secrets related to an iOS zero-day affecting Apple A12 and A13 chips.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed two separate boot-chain security issues that undermine trusted startup protections on major platforms. CERT/CC warned that outdated Microsoft-signed UEFI **shim** bootloaders—especially `shim` version `0.9` and earlier, including forked or unpatched builds used by vendors such as Red Hat Enterprise Linux, CentOS, Oracle, OpenSUSE, and WhiteCanyon—can be abused to bypass **Secure Boot** and run arbitrary code before the operating system loads. Because the attack executes in the early boot phase, it can evade EDR visibility and establish persistent compromise; Microsoft is responding by expanding the UEFI Forbidden Signature Database (**DBX**) to revoke vulnerable bootloaders, while administrators have been urged to update signature databases first and test carefully to avoid leaving systems unbootable. Paradigm Shift also disclosed an **unpatchable BootROM flaw** in Apple `A12` and `A13` chips and released a proof-of-concept exploit, `usbliter8`, showing that affected devices from the iPhone XS through the iPhone 11 line can be compromised during startup. The bug stems from USB controller behavior in SecureROM that allows unauthorized memory writes via crafted packets, enabling temporary reduction of security settings, booting of unsigned software, and the familiar `PWND` USB serial marker after exploitation. Apple was notified before publication, but because the weakness is embedded in silicon, software updates cannot fully eliminate the risk for affected devices over their operational lifetime.
Jun 29, 2026
Security researchers at Paradigm Shift disclosed **`usbliter8`**, a tethered BootROM exploit that achieves privileged SecureROM code execution on Apple devices using **A12** and **A13** processors, as well as **Apple Watch S4/S5** chipsets. The exploit chains a flaw in the **Synopsys DesignWare USB 2 controller** with a firmware configuration weakness in the boot chain, allowing attackers with physical access to modify **DFU mode**, inject custom USB handlers, and boot unsigned **iBoot** images. Researchers said the issue affects immutable BootROM/SecureROM code, meaning software updates cannot fully fix vulnerable devices and hardware replacement is the most effective mitigation. The public release included a GitHub repository and technical write-up describing hardware requirements and exploitation steps. Because the bug is exposed through low-level USB behavior that typical host stacks cannot reach, the exploit uses **RP2350-based microcontroller boards** such as the **Waveshare RP2350 USB-A**, **Waveshare RP2350 Zero**, **Pimoroni TINY2350**, and **Raspberry Pi Pico 2**. Paradigm Shift said **A11** devices are not vulnerable due to different USB driver behavior, while **A14 and later** platforms appear harder to exploit because **DART** is configured correctly; Apple Product Security was notified before publication.
Aug 11, 2026
Researchers have booted a jailbroken build of **iOS 27.0 beta 2** on an **iPhone 11 Pro** by combining the `usbliter8` SecureROM exploit with a heavily modified custom firmware workflow. The demonstration targets **A12 and A13** devices through **DFU mode**, requires physical access and specialized USB hardware, and shows that flaws in Apple’s immutable bootrom can still be used to undermine the boot chain on older hardware even after major iOS upgrades. Because the attack abuses SecureROM code, it cannot be fully fixed through a standard iOS software update. The project reportedly introduced build-specific patches for build `24A5370h` and altered kernel, userland, and system services to bypass protections including **USB Restricted Mode**, sandbox controls, and **AMFI** trust-cache checks. The modified device was able to load altered boot components and support capabilities such as SSH access, a bootstrap environment, and **Sileo**, but the jailbreak remains highly experimental and can disrupt **SEP-dependent features**, passcode support, Wi‑Fi, baseband, Bluetooth, and Apple services. No CVE, CVSS score, Apple advisory, or public evidence of in-the-wild exploitation was reported in the cited coverage.
Jul 27, 2026