Update iOS 18 Pro devices now after untethered jailbreak demo exposes persistent security risks
A security team proved that the latest iPhone software can be fully compromised and survive a restart, signaling a new risk for device owners.
Key points
- Researchers from Calif demonstrated an untethered jailbreak for iOS 27.0.1 on the iPhone 18 Pro at Hexacon 2026 on October 16.
- The exploit allows full root access that persists after a reboot, a capability not seen on modern iPhones since iOS 9, according to Heise.
- Apple has not released a patch for this specific chain, but users should install future security updates as soon as they become available.
Security researchers have shown that Apple’s newest iPhone software can be completely taken over and remain compromised even after the phone is restarted. This demonstration proves that the latest hardware and software are not immune to the most difficult type of mobile attack. The event took place in Paris on October 16, marking a significant shift in the security landscape for current Apple devices.
In plain English
The team from the cybersecurity firm Calif performed a live demonstration at the Hexacon 2026 conference. They rebooted an iPhone 18 Pro running iOS 27.0.1. After the device displayed the Apple logo and unlocked with the passcode, the jailbreak activated automatically. The phone did not need to be connected to a computer. This behavior defines an "untethered" jailbreak. It is rare because the modification survives a full power cycle, which is the hardest hurdle to clear on modern iPhones.
View the original post on X
The background
During the demo, the researchers connected to the phone via SSH on port 2222 and logged in as the root user. System commands confirmed full administrative access and identified the device as an iPhone19,2 running Darwin Kernel 27.0.0. The system had been running for only two minutes. Gaining this level of control usually requires chaining multiple software flaws. An attacker must escape the app sandbox, compromise the kernel, and bypass hardware defenses like Pointer Authentication Codes.
What changes now
Apple released iOS 27 on September 14, which included fixes for more than 120 vulnerabilities, including 20 in the kernel, according to its security notes. This jailbreak targets iOS 27.0.1, released shortly after. Cellebrite had stated weeks earlier that iOS 27 could not be jailbroken on current physical devices. This demonstration contradicts that assessment. Calif has not disclosed the specific flaws used, and no public tool or CVE IDs have been released. Heise reports that AI helped find the exploit chain.
Key terms explained
An untethered jailbreak modifies the operating system so that unauthorized access remains active after a reboot. Teams usually monitor for signs of modified system files or unexpected network connections on port 2222. Check whether your devices are running the latest vendor software. Verify that hardware-backed security features are enabled. Ensure that remote access protocols are restricted to trusted networks. Review logs for root-level activity that does not match normal administrative tasks.
What to do and how to stay safe: iOS 27.0.1
- Install the latest iOS security updates as soon as Apple releases them to patch known vulnerabilities.
- Avoid connecting your iPhone to unknown computers or networks that could trigger exploit chains.
- Monitor system logs for unusual SSH connections or root-level commands that indicate a compromise.
- Keep your device in a secure environment to prevent physical access attacks that require DFU mode.
General security guidance from the Vector Update newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Is there a public tool to jailbreak iOS 27.0.1?
No, Calif has not released a public tool, and no CVEs have been assigned or confirmed for this exploit chain.
Did this jailbreak work on all iPhone models?
The demonstration was performed specifically on the iPhone 18 Pro, which is Apple’s newest device at the time of the event.
How does this differ from previous jailbreaks?
It is the first reboot-proof jailbreak since iOS 9, according to Heise, and it works on the latest public release without breaking core features like Wi-Fi.
