Loading story…
Calif researchers reportedly demonstrated an untethered jailbreak for iOS 27.0.1 on an iPhone 18 Pro at the Hexacon security conference in Paris. The jailbreak survived a full reboot, after which researchers established an SSH session with root privileges, demonstrating persistent access without a computer to reapply the jailbreak. Heise reported that artificial intelligence helped researchers discover the exploit chain, although the underlying vulnerabilities and technical details were not disclosed.
No public jailbreak tool was released, and the exploit chain’s broader device compatibility, prerequisites and delivery method remain unknown. Reporting assessed immediate risk to most users as low because the method is not public, while noting that comparable exploit chains can enable spyware operations. Apple’s response and any remediation were unknown at publication; enterprise security teams should monitor Apple advisories and subsequent disclosures rather than assume the demonstration establishes an available remote attack.
See affected versions and whether adversaries are exploiting it.
6 events from the most recent confirmed update back to the earliest known activity.
Billy Ellis shared footage of the Hexacon demonstration on October 16, 2026, documenting the jailbreak's persistence across a reboot and subsequent root access.
On October 16, Calif researchers demonstrated an untethered jailbreak on an iPhone 18 Pro at Hexacon 2026 in Paris, showing persistence after a full reboot and root access over SSH. AI reportedly helped discover the exploit chain, but the researchers did not disclose the vulnerabilities or release a public jailbreak tool.
Apple released iOS 27 on September 14 with fixes for more than 120 vulnerabilities, including 20 kernel vulnerabilities, according to the reports.
According to Stefan Esser, most vulnerabilities used in Calif.io’s untethered jailbreak are already fixed in the current iOS 27.2 beta. The report also reveals that the exploit chain bypasses Apple’s Memory Integrity Enforcement protection.
Calif.io reportedly attracted attention in August for using artificial intelligence to derive an exploit from Apple's fix for a serious screen-sharing vulnerability. The source does not establish that the same technique was used for the later jailbreak.
Apple Security Research published an overview of Memory Integrity Enforcement, presenting it as a comprehensive approach to memory safety in Apple devices.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
5 references tracked. Mallory keeps watching after this page renders.
heise.de
Open sourcecybersecuritynews.com
Open sourcecryptika.com
Open sourceheise.de
Open sourcesecurity.apple.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers have booted a jailbroken build of **iOS 27.0 beta 2** on an **iPhone 11 Pro** by combining the `usbliter8` SecureROM exploit with a heavily modified custom firmware workflow. The demonstration targets **A12 and A13** devices through **DFU mode**, requires physical access and specialized USB hardware, and shows that flaws in Apple’s immutable bootrom can still be used to undermine the boot chain on older hardware even after major iOS upgrades. Because the attack abuses SecureROM code, it cannot be fully fixed through a standard iOS software update. The project reportedly introduced build-specific patches for build `24A5370h` and altered kernel, userland, and system services to bypass protections including **USB Restricted Mode**, sandbox controls, and **AMFI** trust-cache checks. The modified device was able to load altered boot components and support capabilities such as SSH access, a bootstrap environment, and **Sileo**, but the jailbreak remains highly experimental and can disrupt **SEP-dependent features**, passcode support, Wi‑Fi, baseband, Bluetooth, and Apple services. No CVE, CVSS score, Apple advisory, or public evidence of in-the-wild exploitation was reported in the cited coverage.
Jul 27, 2026
Censys uncovered five exposed open directories revealing a DarkSword/Coruna iOS exploitation and cryptocurrency-theft platform, including exploit stages, delivery infrastructure, administrative tools, and wallet-harvesting modules. DarkSword provides device access through browser exploitation, while Coruna injects wallet-specific theft modules into cryptocurrency applications and searches photos and Apple Notes for valid recovery phrases. A separate production-server capture contained **11 victim recovery phrases, 179 device-loot directories, and a 75-account roster**, supporting researchers’ assessment of a Chinese-speaking commercial exploitation-as-a-service operation with reseller-style administration. These findings do not establish the total number of victims or cryptocurrency losses. Telemetry showed sustained beaconing from two devices in China and Hong Kong. Researchers also identified a separate China-based operator through 22 samples from infections in the wild configured to communicate with 66ds[.]lol; neither operator was named. Development artifacts referenced unfinished iOS 26 exploitation associated with **CVE-2026-31001**, but researchers found no evidence that this chain was operational or deployed. A separate CoreAudio zero-click capability claim also remains unverified. Established exploit chains are reportedly patched, making current iOS updates a priority for organizations supporting iPhones, particularly devices used to access cryptocurrency wallets.
Oct 9, 2026
A security researcher showed that the anti-reverse-engineering controls in an anonymized 64-bit iOS banking app dubbed **VIBA** could be bypassed despite extensive runtime self-protection. The app used obfuscation, encrypted strings, anti-jailbreak checks, anti-`Frida` logic, debugger detection, file-integrity validation, and large volumes of raw syscalls to resist analysis on modified devices. The researcher found several protections relied on weak patterns, including simple XOR string decryption, recognizable success and failure constants, and `ptrace` and `exit` syscalls that could be patched out, allowing checks for Frida files, port `27042`, injected dylibs, jailbreak artifacts, and `Info.plist` integrity to be defeated through static patching and runtime hooking. Separate malware analysis detailed a stealth-focused macOS backdoor known as **Tiny FUD** that masquerades as Apple-like processes, hides itself from Finder, and communicates with a command-and-control server at `69.197.175.10:9999`. The trojan collects host identifiers including UUID, username, hostname, and kernel version, executes remote commands, and captures screenshots every five minutes for exfiltration. Researchers said the sample also used self-signing with permissive entitlements, `DYLD`-related injection support, and cleanup routines to erase traces and terminate itself and child processes, and they published indicators including SHA-256 `d64e2688344c685c4156819156bdb15630d1168314b21c919eee5540b1beb54a`, related domains, and a YARA rule to aid detection.
Jul 12, 2026