Loading story…
Researchers have booted a jailbroken build of iOS 27.0 beta 2 on an iPhone 11 Pro by combining the usbliter8 SecureROM exploit with a heavily modified custom firmware workflow. The demonstration targets A12 and A13 devices through DFU mode, requires physical access and specialized USB hardware, and shows that flaws in Apple’s immutable bootrom can still be used to undermine the boot chain on older hardware even after major iOS upgrades. Because the attack abuses SecureROM code, it cannot be fully fixed through a standard iOS software update.
The project reportedly introduced build-specific patches for build 24A5370h and altered kernel, userland, and system services to bypass protections including USB Restricted Mode, sandbox controls, and AMFI trust-cache checks. The modified device was able to load altered boot components and support capabilities such as SSH access, a bootstrap environment, and Sileo, but the jailbreak remains highly experimental and can disrupt SEP-dependent features, passcode support, Wi‑Fi, baseband, Bluetooth, and Apple services. No CVE, CVSS score, Apple advisory, or public evidence of in-the-wild exploitation was reported in the cited coverage.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Researchers demonstrated a jailbroken build of iOS 27.0 beta 2 running on an A13-based iPhone 11 Pro using the usbliter8 SecureROM exploit and a heavily modified custom firmware workflow. The proof of concept required physical access, DFU mode, and specialized USB hardware, and showed that immutable bootrom flaws can still bypass parts of Apple's boot chain on older hardware.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcecryptika.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers at Paradigm Shift disclosed **`usbliter8`**, a tethered BootROM exploit that achieves privileged SecureROM code execution on Apple devices using **A12** and **A13** processors, as well as **Apple Watch S4/S5** chipsets. The exploit chains a flaw in the **Synopsys DesignWare USB 2 controller** with a firmware configuration weakness in the boot chain, allowing attackers with physical access to modify **DFU mode**, inject custom USB handlers, and boot unsigned **iBoot** images. Researchers said the issue affects immutable BootROM/SecureROM code, meaning software updates cannot fully fix vulnerable devices and hardware replacement is the most effective mitigation. The public release included a GitHub repository and technical write-up describing hardware requirements and exploitation steps. Because the bug is exposed through low-level USB behavior that typical host stacks cannot reach, the exploit uses **RP2350-based microcontroller boards** such as the **Waveshare RP2350 USB-A**, **Waveshare RP2350 Zero**, **Pimoroni TINY2350**, and **Raspberry Pi Pico 2**. Paradigm Shift said **A11** devices are not vulnerable due to different USB driver behavior, while **A14 and later** platforms appear harder to exploit because **DART** is configured correctly; Apple Product Security was notified before publication.
Aug 11, 2026
Researchers disclosed two separate boot-chain security issues that undermine trusted startup protections on major platforms. CERT/CC warned that outdated Microsoft-signed UEFI **shim** bootloaders—especially `shim` version `0.9` and earlier, including forked or unpatched builds used by vendors such as Red Hat Enterprise Linux, CentOS, Oracle, OpenSUSE, and WhiteCanyon—can be abused to bypass **Secure Boot** and run arbitrary code before the operating system loads. Because the attack executes in the early boot phase, it can evade EDR visibility and establish persistent compromise; Microsoft is responding by expanding the UEFI Forbidden Signature Database (**DBX**) to revoke vulnerable bootloaders, while administrators have been urged to update signature databases first and test carefully to avoid leaving systems unbootable. Paradigm Shift also disclosed an **unpatchable BootROM flaw** in Apple `A12` and `A13` chips and released a proof-of-concept exploit, `usbliter8`, showing that affected devices from the iPhone XS through the iPhone 11 line can be compromised during startup. The bug stems from USB controller behavior in SecureROM that allows unauthorized memory writes via crafted packets, enabling temporary reduction of security settings, booting of unsigned software, and the familiar `PWND` USB serial marker after exploitation. Apple was notified before publication, but because the weakness is embedded in silicon, software updates cannot fully eliminate the risk for affected devices over their operational lifetime.
Jun 29, 2026
Apple released emergency security updates for older devices to block exploitation associated with the **Coruna** exploit chain, backporting fixes previously delivered in newer iOS branches. The updates target legacy hardware that cannot move to the latest operating systems, with reporting indicating **iOS 15.8.7** and *iPadOS 15.8.7* protect devices such as the iPhone 6s, iPhone 7, first-generation iPhone SE, iPad Air 2, iPad mini 4, and iPod touch 7. The attack path described for Coruna combines multiple flaws in the **kernel** and **WebKit**, enabling device compromise through malicious web content and potentially leading to arbitrary code execution with elevated privileges. Apple’s security documentation also confirms a related backport in **iOS 16.7.15** and *iPadOS 16.7.15* for slightly newer but still unsupported models, including iPhone 8, iPhone 8 Plus, iPhone X, and several older iPads. That advisory ties the Coruna exploit to **CVE-2023-43010**, a memory corruption issue triggered by processing crafted web content, and states the fix was originally shipped in **iOS 17.2** before being brought to devices unable to upgrade further. Together, the updates show Apple is extending protections against an actively weaponized exploit chain across multiple older device families rather than limiting remediation to current-generation platforms.
Jun 29, 2026