Security Breakthrough: Researchers Demonstrate Untethered Jailbreak for iOS 27.0.1 on iPhone 18 Pro
In a significant development within the cybersecurity landscape, a team of security researchers from Calif (Calif.io) showcased a fully functional untethered jailbreak for iOS 27.0.1, running on an iPhone 18 Pro. This groundbreaking demonstration was made during the Hexacon 2026 offensive security conference, held in Paris on October 16, 2026. Notably, the event marks the debut of the first reboot-proof jailbreak since the introduction of iOS 9. According to reports from Heise, artificial intelligence played a crucial role in identifying the exploit chain that enabled this jailbreak, highlighting an intriguing intersection of modern technology and cybersecurity.
The demonstration, which captured significant attention online, occurred on a stage organized by Synacktiv and involved live footage shared across social media platforms like X. During the presentation, the researchers successfully rebooted the iPhone 18 Pro. Upon reaching the lock screen, they accessed the device using the correct passcode, thereby confirming the effectiveness of the jailbreak. What sets this jailbreak apart from others is its untethered nature—meaning it remains functional even after a full device reboot. This characteristic is particularly challenging to achieve on contemporary iPhones, making it one of the rarest and most complex jailbreaks to develop.
As the demonstration progressed, the team demonstrated their ability to connect to the device over SSH on port 2222, subsequently logging in as root. The output of the "id" command promptly returned "uid=0," thereby confirming full root access to the device’s operating system. Further details highlighted in the demo included specific technical specifications such as the kernel version (Darwin 27.0.0, XNU 13432.2.10), model (iPhone19,2), and OS version (iOS 27.0.1, build 24A446). During the demo, the device was reported to have 67 packages installed via dpkg and an uptime of about two minutes, succinctly summarizing the researchers’ success in establishing a root shell within an impressively short timeframe.
International Cyber Digest summarized the event by noting that gaining root access on a current iPhone typically necessitates a series of vulnerabilities to exploit. An attacker ordinarily needs to escape the app sandbox, control the kernel, and circumvent hardware-backed defenses such as Pointer Authentication Codes (PAC). The challenge of maintaining persistence across device reboots is particularly formidable, as Apple routinely verifies all code executing during the startup process.
Prior to this remarkable demonstration, Apple released iOS 27 on September 14, which addressed more than 120 security flaws, including 20 within the kernel, as detailed in their security updates. Remarkably, just weeks before Calif’s announcement, Cellebrite had asserted that iOS 27 could not be jailbroken on any extant physical device. This assertion, however, has been effectively rebutted by the recent demonstration.
Earlier attempts to jailbreak iOS 27 had yielded mixed results, as seen with the usbliter8 SecureROM exploit, which was capable of booting a jailbroken version of the iOS 27.0 beta 2 on an iPhone 11 Pro. This exploit required physical access, DFU mode, and specialized USB hardware, but it had notable limitations, including the disabling of features reliant on the Secure Enclave (SEP), as well as issues with Wi-Fi and the baseband. The demonstration by Calif, in contrast, not only utilized the latest public release but also successfully operated on the most current Apple hardware available.
Currently, Calif has not disclosed the specific vulnerabilities it leveraged in this untethered jailbreak, and no public tools have been made available as of yet. Additionally, no Common Vulnerabilities and Exposures (CVEs) have been assigned or confirmed related to this exploit. However, a post from ONE Jailbreak suggested that the work might be released “in due time,” although this claim remains unverified by Calif itself.
For the average user, the immediate risk posed by this newly discovered jailbreak is minimal, primarily since the method remains unpublished. However, the nature of such exploits often leads to concern, as spyware vendors frequently utilize similar exploit chains. Consequently, it’s essential for individuals—especially those in high-risk positions like journalists, activists, and executives—to take preemptive security measures. These include promptly installing any forthcoming iOS security updates from Apple, enabling Lockdown Mode, and treating any online tools claiming to jailbreak iOS 27 as potentially malicious. Users should also remain vigilant by monitoring Apple’s security release notes for any kernel, sandbox, or PAC-related fixes attributed to Calif.
Going forward, one critical question lingers: does the exploit chain rely on a single patchable set of vulnerabilities, or is it built upon a more foundational systemic weakness? Until Calif provides further details to Apple and those fixes are integrated into future updates, the full scope and implications of this exploit remain uncertain. The demonstration at Hexacon has undoubtedly sparked renewed interest and excitement within the cybersecurity community, underscoring the ever-evolving landscape of mobile security and the ongoing cat-and-mouse game between researchers and developers.