Security firm Calif showed a set of iPhone hacks on stage at the Hexacon offensive security conference in Paris on Friday. According to an attendee and to Decrypt, they included an untethered jailbreak of an iPhone 18 Pro running iOS 27.0.1 that survives a reboot. Calif has not named the bugs it used or released a tool. It says the details will come later.
What Calif has confirmed
In a newsletter post titled “iPhone”, Calif wrote: “Today, we hacked what we’d set out to hack: the iPhone.” It added: “Below is a series of demos we revealed at Hexacon in Paris today. Everything will be released in due time.”
The post lists four demo videos, titled “1/ Signal 1-click”, “2/ But who cares about a third-party app when everyone uses iMessage, right?”, “3/ Can your iPhone do this?” and “4/ APT stands for Apple Persistent Threat”. Calif posted the same message in a thread on X. Neither the newsletter nor the thread explains in writing how the demos work, which bugs they rely on, or which device and iOS version each one ran on.
What was reported from the room
Security researcher Billy Ellis was at the talk. “At #hexacon – calif.io demos iOS 27.0.1 untethered jailbreak on iPhone 18 Pro,” he wrote, sharing a short video of the demo (via @bellis1000 on X). In a follow-up reply, he said Calif told the audience at the end of the talk “something along the lines of ‘this will all be released in due time'”.
Decrypt reported that the video shows the team rebooting the phone, unlocking it with the normal passcode and opening an SSH session as root, the highest level of access on the device. The terminal output listed iOS 27.0.1 and an uptime of about two minutes, which suggests the access came back on its own after the restart. TSN has not independently examined the footage.
What “untethered” means
A jailbreak removes the software restrictions Apple builds into iOS, giving the user root access to the system. Apple designs the iPhone as a locked-down device, with signed code, a sandbox around each app and a protected start-up chain, so that owners cannot change how iOS works or run software Apple has not approved.
“Untethered” means the jailbreak comes back by itself after a restart, without the phone being connected to a computer. Decrypt notes that getting root on a current iPhone usually takes a chain of bugs to escape the app sandbox, take over the kernel and get past hardware-backed defences such as Pointer Authentication Codes. Surviving a reboot is harder still, because Apple checks the code that runs at start-up.
Why it matters
Few people jailbreak their phones today, but a working chain on current hardware shows that Apple’s heavy investment in defences can still be beaten. As Decrypt points out, a chain that gives root on a fully updated iPhone is the same kind of capability commercial spyware vendors sell. Apple usually patches such chains once it learns the details, so how long iOS 27.0.1 stays exposed depends largely on when Calif publishes, or when it shares its findings with Apple.
What we don’t know
- Which vulnerabilities Calif chained together. None have been named, and no exploit details are public.
- When Calif will release its findings, and whether a public jailbreak tool will follow.
- Whether Apple already knows about the bugs or has a fix planned. Apple had not commented as of Friday, Decrypt reported, and says it does not confirm security issues until patches are available.
- Exactly what the Signal, iMessage and “Apple Persistent Threat” demos showed, beyond their titles.
What this means
- Calif confirmed it demonstrated iPhone hacks at Hexacon in Paris and says everything “will be released in due time”.
- An attendee and Decrypt report one demo was an untethered iOS 27.0.1 jailbreak on an iPhone 18 Pro that kept root access after a reboot.
- No bugs, exploit details or tools are public, and Apple has not commented. There is nothing for users to do until Apple ships an update. Keeping iOS up to date remains the standard advice.
Sources
- Calif Newsletter: iPhone
- Calif (@calif_io) on X
- Billy Ellis (@bellis1000) on X
- Billy Ellis (@bellis1000) on X, follow-up
- Decrypt: Hackers Jailbreak iPhone 18 Pro on Stage, and It Survives a Reboot
Related stories
- Epoch AI Says Open-Weight Models Trail Closed Ones on Cyber Skills by 6-7 Months
- Anthropic’s Cyber Verification Program: Three Tiers of Looser Guardrails for Vetted Defenders
- Chainguard Launches Three Tools to Keep AI Coding Agents Contained, Checked and Hunting for Bugs
Follow @tsnmediahub on X for breaking AI news as it happens.
Follow on X
