Calif Researchers Demonstrate Untethered Jailbreak for iOS 27.0.1 on iPhone 18 Pro
Security firm Calif showed a persistent root exploit on Apple’s latest device at Hexacon 2026 in Paris, marking a rare early breach of the new OS.
Key points
- Calif researchers demonstrated an untethered jailbreak for iOS 27.0.1 on the iPhone 18 Pro at Hexacon 2026 on October 16.
- The exploit survives a full reboot without a computer connection, granting root access via SSH on port 2222.
- No public tool or specific vulnerability details have been released, though Apple patched over 120 flaws in the initial iOS 27 release.
Security researchers from the cybersecurity firm Calif demonstrated a working untethered jailbreak for iOS 27.0.1 on Apple’s iPhone 18 Pro during a live presentation. The demonstration occurred at Hexacon 2026, an offensive security conference organized by Synacktiv in Paris on October 16. This event serves as one of the first public indications that Apple’s newest hardware and software can be fully compromised shortly after their release.
The team restarted the iPhone 18 Pro on stage, allowing it to boot through the Apple logo and lock screen before unlocking it with a passcode. Crucially, the jailbreak reactivated automatically without the device being connected to a computer, which defines an "untethered" exploit. This capability is considered the most difficult and rarest type to develop for modern iPhones because it persists across full system reboots.
View the original post on X
Technical Details and Context
After the reboot, the researchers connected to the phone via SSH on port 2222 and logged in as the root user. Executing the id command returned uid=0, confirming full root access. The uname output displayed Darwin Kernel 27.0.0, built on XNU 13432.2.10 for the T8160 chip, with the model identified as iPhone19,2. The sw_vers command verified the system was running iOS 27.0.1, build 24A446.
The neofetch utility listed 67 packages installed through dpkg and showed a system uptime of only two minutes. Gaining root access on current iPhones typically requires chaining multiple vulnerabilities. An attacker must escape the application sandbox, compromise the kernel, and bypass hardware-backed protections such as Pointer Authentication Codes (PAC). Maintaining that access after a reboot is even more challenging because Apple verifies the code executing during startup.
Vendor Response and Vulnerability Landscape
The researchers have not disclosed the specific flaws used in this exploit, and no public exploitation tool has been released. Apple launched iOS 27 on September 14, which included fixes for more than 120 vulnerabilities, including 20 in the kernel, according to its official security notes. This release was part of a broader update that addressed 273 vulnerabilities across all Apple devices. Earlier this year, Apple also patched an actively exploited iOS zero-day that had been used against targeted individuals.
Who Is Affected
For the general user base, the immediate risk remains low because the exploitation method is not publicly available. However, the demonstration highlights that sophisticated attackers can potentially achieve full control over the latest iPhone models. Spyware developers often utilize similar chains of bugs to compromise devices for surveillance purposes. The fact that this exploit works on iOS 27.0.1 suggests that even recent security updates may not fully mitigate all attack vectors against the newest hardware.
What should you do?
Since no patch has been confirmed for this specific exploit chain, users should monitor official channels for updates. The researchers did not release a tool, but the underlying vulnerabilities could be weaponized. Installing security updates promptly is the primary defense against such kernel-level compromises.
What to do and how to stay safe: iOS 27.0.1
- Install Apple’s next security update for iOS 27 as soon as it becomes available to address potential underlying flaws.
- Avoid connecting your iPhone to untrusted computers or networks that could facilitate unauthorized SSH access.
- Monitor official Apple security advisories for disclosures regarding kernel vulnerabilities or zero-day patches.
- Enable two-factor authentication on your Apple ID to add an extra layer of protection if device access is compromised.
Step-by-step guide: Mobile Device Security: How to Protect Data Beyond Passwords
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Is there a public tool to jailbreak iOS 27.0.1?
No, the researchers from Calif have not released a public tool or disclosed the specific vulnerabilities used in their demonstration.
What does an untethered jailbreak mean?
It means the jailbreak survives a full reboot of the device without needing to be reconnected to a computer, providing persistent root access.
Did Apple release a fix for this specific exploit?
No, the source material does not state that Apple has released a fix for this specific untethered jailbreak method demonstrated by Calif.
