Loading story…
The Relapse exploit chain enables jailbreaks on PlayStation 5 and PS5 Pro systems running firmware 7.00–13.60, substantially broadening the pool of compatible consoles beyond earlier methods. Delivered through the console browser, it chains a WebKit/JavaScriptCore memory-corruption flaw with a kernel aio_multi_wait use-after-free race to obtain kernel read/write access, then launches an ELF payload loader on TCP port 9021. The access supports homebrew payloads including etaHEN and has been used to enable emulation.
The jailbreak does not support Sony firmware 14.00 or later, creating an immediate trade-off for affected owners: updating can permanently remove access to Relapse, while remaining on a vulnerable version can prevent installation of games or updates that require newer firmware. Researchers and project maintainers warn that exploitation attempts can stall the browser, hang or panic the console, cause instability or data loss, and potentially result in PlayStation Network account bans.
See which actors are running it and whether you're in range.
3 events from the most recent confirmed update back to the earliest known activity.
The Relapse exploit chain was released for jailbreaking supported PlayStation 5 consoles, including PS5 Pro systems on compatible firmware. It uses browser/WebKit and kernel exploitation to gain kernel read/write access and launches an ELF loader for payload execution.
Sony released PS5 firmware 14.00.00, which is outside Relapse's supported firmware range. Some game updates, including a digital Marvel's Wolverine update, reportedly require firmware 14.00.
Sony released PS5 firmware version 13.60. Relapse supports consoles running this version and earlier supported firmware releases.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
3 references tracked. Mallory keeps watching after this page renders.
tomshardware.com
Open sourcearstechnica.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers have booted a jailbroken build of **iOS 27.0 beta 2** on an **iPhone 11 Pro** by combining the `usbliter8` SecureROM exploit with a heavily modified custom firmware workflow. The demonstration targets **A12 and A13** devices through **DFU mode**, requires physical access and specialized USB hardware, and shows that flaws in Apple’s immutable bootrom can still be used to undermine the boot chain on older hardware even after major iOS upgrades. Because the attack abuses SecureROM code, it cannot be fully fixed through a standard iOS software update. The project reportedly introduced build-specific patches for build `24A5370h` and altered kernel, userland, and system services to bypass protections including **USB Restricted Mode**, sandbox controls, and **AMFI** trust-cache checks. The modified device was able to load altered boot components and support capabilities such as SSH access, a bootstrap environment, and **Sileo**, but the jailbreak remains highly experimental and can disrupt **SEP-dependent features**, passcode support, Wi‑Fi, baseband, Bluetooth, and Apple services. No CVE, CVSS score, Apple advisory, or public evidence of in-the-wild exploitation was reported in the cited coverage.
Jul 27, 2026
Sony filed suit against George Hotz (**Geohot**) and members of **fail0verflow** after the PlayStation 3 jailbreak was published, seeking injunctions, turnover of hardware and software containing the code, and damages under claims including the **DMCA**, **CFAA**, California computer crime statutes, contributory copyright infringement, and violations of PlayStation Network terms. The legal action followed public disclosures showing that Hotz had combined hardware and software techniques to break into the PS3, while researchers and academics mirrored the jailbreak code in protest, arguing the publication raised First Amendment issues. Technical disclosures around the jailbreak showed that the PS3’s security model—despite its chain of trust, signed executables, hypervisor isolation, and anti-downgrade protections—had been undermined by multiple flaws. Researchers described attacks ranging from memory glitching and USB-based exploitation to downgrade abuse, culminating in a critical **ECDSA** implementation error in which Sony reused a non-random signing value, allowing recovery of private signing keys and enabling attackers to sign arbitrary code. The compromise opened the door to homebrew software and piracy, turning Sony’s platform-security dispute into both a major legal fight and a high-profile failure of console trust architecture.
Jun 29, 2026
Researchers disclosed two separate boot-chain security issues that undermine trusted startup protections on major platforms. CERT/CC warned that outdated Microsoft-signed UEFI **shim** bootloaders—especially `shim` version `0.9` and earlier, including forked or unpatched builds used by vendors such as Red Hat Enterprise Linux, CentOS, Oracle, OpenSUSE, and WhiteCanyon—can be abused to bypass **Secure Boot** and run arbitrary code before the operating system loads. Because the attack executes in the early boot phase, it can evade EDR visibility and establish persistent compromise; Microsoft is responding by expanding the UEFI Forbidden Signature Database (**DBX**) to revoke vulnerable bootloaders, while administrators have been urged to update signature databases first and test carefully to avoid leaving systems unbootable. Paradigm Shift also disclosed an **unpatchable BootROM flaw** in Apple `A12` and `A13` chips and released a proof-of-concept exploit, `usbliter8`, showing that affected devices from the iPhone XS through the iPhone 11 line can be compromised during startup. The bug stems from USB controller behavior in SecureROM that allows unauthorized memory writes via crafted packets, enabling temporary reduction of security settings, booting of unsigned software, and the familiar `PWND` USB serial marker after exploitation. Apple was notified before publication, but because the weakness is embedded in silicon, software updates cannot fully eliminate the risk for affected devices over their operational lifetime.
Jun 29, 2026