TL;DR - At an offensive-security conference in Paris, researchers demoed a jailbreak that survives reboots on an iPhone 18 Pro running iOS 27.0.1, Apple's current release. The same team showed one-tap attacks on Signal and iMessage, both starting with a malicious PDF. Signal's maths held the whole time. The phone fell. Apple has already fixed most of the exploit chain in the iOS 27.2 beta, but iOS 27.1, the version that's out now, doesn't install on your phone at all. What you need to do: turn on automatic updates today and install 27.2 the day it ships, stop reading the encryption padlock as an all-clear, switch on Lockdown Mode for anyone at elevated risk, and keep applying the oldest rule in email to your encrypted chats - don't open the PDF you weren't expecting.
| Fact | Number |
|---|---|
| Date of the Hexacon demos | 16 October 2026 |
| Target | iPhone 18 Pro on iOS 27.0.1, Apple's current release |
| Previous reboot-surviving iPhone jailbreak | iOS 9 era - none since, per Heise |
| Taps needed to start the Signal/iMessage demo | 1 (a booby-trapped PDF) |
| Apple memory defence bypassed | MIE, built on ARM's EMTE |
| Calif-linked fixes in Apple's 19 October advisory update | 2 (kernel + TCC) |
| Security fixes in iOS 27.1 for your existing iPhone | 0 - it installs on the new iPhone Duo only |
| iOS 27.2 | In beta, and it already fixes most of the chain, per Calif |
Last Friday, at an offensive-security conference in Paris, a research firm called Calif put an iPhone 18 Pro on stage and rebooted it. The phone came back to the lock screen, someone typed the passcode, and a root shell came back with it. No computer tethered to the phone. Nothing re-run by hand. The jailbreak just returned, on iOS 27.0.1 - the newest version of iOS that ordinary iPhones can install.
I've been doing security long enough to be suspicious of stage demos. This one is different, and Heise's reporting explains why: it's the first reboot-surviving (untethered) jailbreak since the iOS 9 era. That class of break was widely considered close to extinct on modern hardware. The same team also showed a custom app taking over a device, and persistence that holds across reboots - the reason their fourth demo slide reads "APT stands for Apple Persistent Threat."
Then there's the part I can't shake. The same team demoed one-tap attacks on Signal and iMessage. Both start the same way: a PDF arrives, the target taps it, and the chain begins. Signal's encryption wasn't broken. iMessage's encryption wasn't broken. The apps worked exactly as designed. The attack never touched the tunnel - it waited at the other end of it, inside the phone.
If you run IT for an SMB, or you're the person your relatives call when their phone "acts weird", this story is about you. Let me walk you through what happened, why it matters, and what to do about it.
What actually happened in Paris
The event was Hexacon, an offensive-security conference in Paris organised by the folks at Synacktiv. The firm on stage is Calif, a Palo Alto research company built around AI-accelerated vulnerability research. The credentials are real: CEO Thai Duong spent twelve years on security and cryptography at Google, co-created the Tink and Wycheproof crypto libraries, and co-discovered the BEAST, CRIME and POODLE TLS attacks. The team also includes Stefan Esser, a German iOS security researcher who has been poking at that platform longer than most of us have had App Store accounts.
Four demos went up on the blog the same day, and Calif's X feed carries the videos. The jailbreak: reboot, passcode, root shell, about two minutes of uptime on the clock. A Signal one-click attack. An iMessage one-click attack - introduced, only slightly cheekily, with the line "who cares about a third-party app when everyone uses iMessage, right?" A custom-app takeover. And persistence across reboots.
The blog post itself is five lines long and ends with "Everything will be released in due time." No bug lists, no tool, no CVEs for the chain. That restraint is deliberate, and it turns out there's a plan behind it - more on that in a moment.
Why this jailbreak is a different animal
Three things separate this from the usual conference flex.
First, it's untethered. A tethered jailbreak dies on reboot unless you reconnect a computer and re-run it. An untethered one survives like any other piece of installed software. Apple's secure boot chain is specifically engineered so that this can't happen, which is why the last untethered break predated the notch.
Second, it beats Apple's newest memory defences. Memory Integrity Enforcement (MIE) builds on ARM's Enhanced Memory Tagging Extension (EMTE) and is supposed to make exactly this class of exploit - memory corruption turning into code execution - disproportionately expensive. Per Heise, the chain bypasses it, and Esser told Mac & i the jailbreak works on essentially any iPhone running iOS 27.0.1.
Third, the timing humiliates the "impossible" narrative. Cellebrite's own assessment weeks earlier said iOS 27 couldn't be jailbroken on any current physical device. Nine days later, it was done on stage, on the newest hardware, on the newest public OS. Vendors write those assessments for courts and customers. Attackers read them as a challenge.
One honest caveat: a stage demo is not a weapon in your threat model. There's no public tool, no device matrix, no ETA. But before anyone files this under "researchers being researchers", consider what Citizen Lab published the day before Hexacon: AdFection, the first technical confirmation of zero-click mercenary spyware delivered through targeted ads. Forty-five devices at Al Jazeera infected with Candiru implants. Ads carrying attack code shown across more than 70,000 apps and 120,000 websites. The question "who would bother attacking phones this way?" answered itself twenty-four hours before the demo.
The part that should actually worry you: encryption wasn't beaten
Here's the mechanic, because it's the part most coverage skips.
End-to-end encryption protects a message while it moves. It's maths applied between two devices, and it genuinely works - nobody read those messages in transit. But a message has two endpoints, and the attack doesn't attack the maths. It compromises one endpoint and reads the message after decryption, on the inside, where the padlock doesn't reach.
The green padlock tells you nobody read the message in transit. It says nothing about who's reading it on the phone.
That's what the Signal and iMessage demos actually prove. A PDF arrives. Someone taps it. The PDF parser - the code that renders documents - is the entry point, and from there the chain works up: escape the app's sandbox, take the kernel, install persistence. Once you're root on an iPhone, the message database, the keylogger, the microphone and the screen are all just API calls. The encrypted-at-rest storage opens the moment the owner types the passcode. The attacker doesn't need to break Signal any more than a burglar needs to pick the lock of a house whose owner let him in through the front door.
None of this is new in principle. The tapped attachment is the oldest trick in email. What's new is the proof that it works end-to-end - entry to persistence - on a fully patched, current-generation iPhone, and that the same trick lands in the two most popular encrypted messengers on the planet.
The update ladder is weird right now: 27.1 isn't for you
Apple's own security page says the quiet part out loud: the latest iOS for existing iPhones is 27.0.1, "and 27.1 for iPhone Duo only". iOS 27.1 shipped for Apple's new foldable, and it carries no published security fixes for anyone. If you were waiting for 27.1 to save you - it was never offered to your device.
The fix train for this jailbreak is iOS 27.2, and it's already rolling. Apple's iOS 27 advisory, updated 19 October, credits Calif researchers on a kernel out-of-bounds-write fix (CVE-2026-28968) and a TCC path-traversal fix (CVE-2026-86886). Apple doesn't claim either one was in the demo chain, and I won't pretend it did - but kernel memory corruption and TCC bypasses are exactly the tiers a chain like this is built from.
The same advisory credits Calif.io "in collaboration with Claude and Anthropic Research" on two older entries (CVE-2026-65410 and CVE-2026-65409). Anthropic's model appears in Apple's thank-you list. Sit with that for a second.
As for disclosure, Esser told Mac & i the chain is a collection of vulnerabilities Calif has already reported to Apple "over the last few months or is about to report", that most are already fixed in the 27.2 beta, and that the team will publish once Apple ships - no end-user jailbreak tool, though a proof of concept may come. That's coordinated disclosure, done by the book, with the awkward gap between stage and patch taken up by restraint.
The AI angle, minus the hype
Heise reports that AI helped build the chain, and Esser's account of how is more interesting than the headline.
Calif evaluates frontier models for vulnerability research, discovery and exploitation. But: "Pointing a model at an iPhone and telling it to hack it is still science fiction." The recipe that worked pairs the models with humans who have deep platform knowledge. And the bottleneck, in his telling, isn't finding bugs - plenty of players are finding plenty of crashes with fuzzers and LLMs, which is why Apple's advisories are full of bug collisions. It's "the unicorns that actually are exploitable" under memory tagging, and the stable exploit code that turns one into a chain.
I wrote last week about PHP2Shell - two critical PHP RCEs found with frontier-model help, patched on an emergency timeline. Anthropic is in Apple's credits. OpenAI is running a whole program that pays for AI-found bugs. The industry argument about whether AI finds real vulnerabilities is over; the credits pages settled it. What's still scarce, and what still decides outcomes, is the human expertise that turns a crash into a working chain - which is either reassuring or terrifying depending on how many of those people your adversary employs.
Why this could be good
Three genuinely positive things, because the doom read isn't the full picture.
The disclosure worked the way the system is supposed to. Research, private reports to Apple, fixes landing in beta, public disclosure after the ships sail. The alternative path - selling the chain to a broker and letting it surface in someone's messaging app - is the AdFection road, and Calif didn't take it.
The defences forced the price up. MIE and EMTE didn't stop a determined, well-resourced team, but the chain took months, veterans, AI tooling and a collection of bugs rather than one magic flaw. That's what winning slowly looks like in this field: not impossible, expensive.
And the boring controls still bite. Every version of this attack starts with a tap, or with a device that missed its updates. The defences that cost nothing - patch discipline, fewer privileged apps, message hygiene - apply exactly as they did last month.
What you should do right now
- Turn on automatic iOS updates today. The fix for most of this chain is iOS 27.2, currently in beta. When it ships, take it day one. Don't wait for the weekend.
- Don't install iOS 27.1 expecting protection. Your iPhone can't even install it - per Apple it's the iPhone Duo only, and it lists no security fixes. Your phone is on 27.0.1 until 27.2 arrives. That's normal this cycle, not an Apple conspiracy.
- Apply the email rule to encrypted chat. An unexpected PDF in Signal, iMessage or WhatsApp gets the same treatment as an unexpected attachment in your inbox: don't tap it. Confirm through another channel if it matters.
- Turn on Lockdown Mode for anyone at elevated risk. Executives with a public face, journalists, activists, anyone dealing with a stalker or a bitter dispute. It trades some convenience for a much smaller attack surface, and Apple documents exactly how.
- Never install a "jailbreak tool" from the internet. Calif says it won't release an end-user tool. Anything using their name will be malware wearing a hoodie.
- If you run BYOD fleets, update the risk register. Assume a compromised handset means a read-only view of every message your staff send from it - Signal, iMessage, WhatsApp, Teams, all of it. Watch for 27.2 and push it fast. MDM can't save a device whose owner tapped the PDF.
Key takeaways
- The strongest iPhone defences in years were beaten on stage - untethered, on current hardware and current software, bypassing Apple's memory-tagging tier.
- Encryption was never the target. Signal and iMessage both fell to a tapped PDF after decryption, which no cipher can prevent.
- iOS 27.1 will not save you - it's the iPhone Duo's update, with no published security fixes. The fix train is iOS 27.2, already in beta.
- Disclosure is coming by the book. Calif reported to Apple first, most of the chain is fixed in beta, publication follows the ship.
- The credits pages now name AI models. Anthropic appears in Apple's advisory; the scarce resource is human exploit expertise, not crash-finding.
- The old rules still work. Updates fast, taps careful, Lockdown Mode for the exposed.
FAQ
Is my iPhone at risk right now? Not from any public tool - there isn't one, and Calif says it won't ship an end-user jailbreak. The realistic risk today is targeted attackers with private capability, which is who mercenary spyware buyers have always been. Install 27.2 the day it lands.
Did they break Signal's encryption? No. The messaging stayed encrypted end to end. The attack compromises the phone and reads messages after decryption, which is a device-security failure, not a cryptography failure.
Is there a jailbreak tool I can download? No. No package, no compatibility list, no release date. Anything branded with Calif's name is malware pretending to be research.
What does "untethered" mean? The jailbreak survives a reboot without reconnecting the phone to a computer. It's the hardest class to build on modern iPhones, and the last one predates the iPhone 7.
Should I install iOS 27.1? You probably can't - Apple offers it only for the new iPhone Duo. For every other iPhone, 27.0.1 is current until 27.2 ships.
We're a business. What's the IT-specific move? Update the BYOD risk register: a compromised phone is read access to every message your staff send from it, in every app. Push 27.2 aggressively when it ships, and put the tapped-attachment rule in the security awareness refresher - the channel changed, the rule didn't.
Who is at highest risk from this class of attack? The people mercenary spyware targets: journalists, activists, diplomats, executives, and anyone in a dispute with someone wealthy enough to buy capability. For them, Lockdown Mode plus fast updates plus message hygiene is the stack.
My take
The framing that stuck with me comes from thinking about states, not headlines. A bug discovery can end three ways: disclosed and patched, gated and sold to defenders, or demonstrated and withheld. The first builds trust. The second builds a business. The third is just a loaded gun on the table, and for eight days the industry got to watch someone hold it. Calif put it down the right way - reports first, publication after the ships - but the loaded days are the story, because spyware brokers were open for business the whole time. Citizen Lab's AdFection report proved the buyers are out there, on schedule, with the ads already running.
The other thing I'd tell my team: the AI argument is settled, and it settled in a boring direction. Anthropic is thanked in an Apple advisory. PHP shipped critical fixes on an emergency timeline for model-assisted findings. And the man whose team did the hardest iPhone chain in a decade says pointing a model at a phone is science fiction. Both things are true, and the space between them - models that find crashes, humans who write exploits - is where the next five years of endpoint security lives. Budget accordingly.
Signal's maths held. The phone fell. Buy better phones, patch them faster, and stop forwarding PDFs.
Mathew Clark Founder, SecureInSeconds Currently: reading Apple release notes for fun. It's a living.
Further reading
- Heise: Calif.io jailbreak - How the untethered tool cracks iOS 27.0.1
- Heise: Works on iPhone 18 Pro - AI helps create untethered jailbreak
- Apple: About the security content of iOS 27 and iPadOS 27
- Apple: iOS 27.1 is iPhone Duo only - security releases page
- Apple: Lockdown Mode
- Calif: the Hexacon iPhone demo post
- Citizen Lab: Exposing AdFection - zero-click spyware via targeted ads
- Ars Technica: Targeted ads delivered 0-click exploits
- SecureInSeconds: PHP2Shell Is Coming - Your Patch Window Is 15 Minutes
- SecureInSeconds: CARLIY0S and the AI Heist Playbook
