Skip to content
NX
App

Root After Reboot: The Untethered iOS 27 Jailbreak Just Broke Apple's Decade-Long Streak — Live, On Stage, In Paris

Tech Minute x/techminute ·
Root After Reboot: The Untethered iOS 27 Jailbreak Just Broke Apple's Decade-Long Streak — Live, On Stage, In Paris

Root After Reboot: The Untethered iOS 27 Jailbreak Just Broke Apple's Decade-Long Streak — Live, On Stage, In Paris

Published: October 24, 2026 | Reading Time: ~12 minutes | Channel: techminute

Two minutes. That's all the proof anyone needed.

On October 16, at Hexacon — Paris's offensive-security conference, organized this year by the exploit specialists at Synacktiv — a researcher from a Palo Alto firm called Calif rebooted an iPhone 18 Pro in front of a live audience. The phone came back up, was unlocked with its normal passcode, and then opened an SSH session as root. Neofetch on the screen showed an uptime of two minutes. The operating system: iOS 27.0.1, Apple's current public release.

For the first time in roughly a decade, an untethered jailbreak — a break that survives a reboot without ever reconnecting to a computer — had been demonstrated on Apple's latest hardware and its latest software, on stage, in one unedited take. The X thread posting the demos has racked up more than 3,600 likes. And this morning, Hacker News is arguing about it at scale: the post "Today, we hacked what we'd set out to hack: the iPhone" sits on the front page with 956 points and 619 comments, nearly a full day after it was submitted.

But the reboot is only half the story. Calif published four demos that day. One of them is a one-click attack on Signal. Another targets iMessage — introduced with a line of pure contempt: "But who cares about a third-party app when everyone uses iMessage, right?" And the fourth redefines three letters that security professionals had reserved for state adversaries: APT, in Calif's phrasing, stands for Apple Persistent Threat.

That's not a product announcement. That's a threat model revision — for every iPhone on the planet.

What "Untethered" Actually Means — and Why It Hasn't Happened in Years

Jailbreak terminology sounds obscure until you understand that it describes exactly how dangerous a bug is.

A tethered jailbreak dies every time the phone restarts. The phone boots normally, the modification evaporates, and you have to re-jailbreak from a computer. Annoying, limiting, and — from a security standpoint — largely a hobbyist curiosity.

A semi-tethered or semi-untethered break (think checkm8-era tools like palera1n, or the modern Dopamine rootless jailbreaks) survives a reboot only with help: re-run a tool, re-sign an app, or accept that signed certificates will expire and take your jailbreak with them.

An untethered jailbreak is the nightmare category: the phone reboots and stays broken. That requires not just escaping the app sandbox and compromising the kernel — the usual chain for any iPhone exploit — but also defeating Apple's secure boot chain, which cryptographically verifies every stage of the startup process, layer by layer, from hardware fuses to kernel. Every boot, on every phone, the chain re-verifies itself. To stay jailbroken across a reboot, the attack must either corrupt the verification itself or persist somewhere the verification doesn't look.

Boot-chain layers unlocking — an illustration of what an untethered jailbreak defeats

This is why untethered jailbreaks went extinct. The last epoch when they were common ended with the bootROM-era bugs like checkm8, a hardware flaw affecting iPhones up through the iPhone X that could never be patched in software. Since then, publicly known jailbreaks on modern hardware have been semi-tethered at best, and on Apple's newest chips — the past several generations — effectively nonexistent. The Glitchwire report from Hexacon called it, "by several accounts, the first untethered break since iOS 9." That's a nine-or-so-year drought, ended by a company most people had never heard of eleven weeks ago.

The demonstration format matters as much as the claim. Calif didn't publish a video they could have cut, or a paper nobody can reproduce. They rebooted the phone in the room. As the Taiwan tech site 電腦王阿達 (kocpc) put it in its writeup: restart, enter passcode, SSH as root, uptime two minutes — "no editing room" for tricks. It's the most unfakeable demo format in security, and it means we're not debating a claim. We're watching the chain work.

Who Is Calif — and Why Their Résumé Makes This Credible

A stage demo can be staged. A company's track record can't — and Calif's is the reason security researchers took this seriously within minutes rather than years.

Calif is led by Thai Duong, who spent twelve years at Google in security and cryptography. He co-created Tink and Wycheproof — Google's widely used cryptographic libraries — and, with researcher Juliano Rizzo, co-discovered three of the most infamous transport-layer attacks in history: BEAST, CRIME, and POODLE. Those two won a Pwnie Award (security research's closest thing to an Oscar) for Best Server-Side Bug.

The bench goes deeper. Per kocpc's profile of the team: Michal Zalewski, author of the AFL fuzzer that reshaped how the industry finds memory bugs; Bruce Dang, who analyzed Stuxnet and worked at Apple; Dion Blazakis, co-author of the iOS Hacker's Handbook and winner of the iPhone category at Pwn2Own 2011; with Google's legendary "Security Princess" Parisa Tabriz listed as an advisor. Roughly sixty people across five continents, whose clients — according to kocpc — include OpenAI, Anthropic, Google, Cursor, and xAI for AI red-teaming and security engineering.

In other words: this is not a jailbreak-cum-monetization crew. This is an elite offensive-security shop whose entire brand is finding catastrophic bugs in the most hardened software on earth — and whose public disclosures have been consistent, sourced, and verifiable.

The Part That Should Actually Worry Everyone: AI Found the Bugs

Here's the line buried in Heise's English-language coverage that deserves more attention than the reboot itself: "It's known that artificial intelligence once again helped find the exploit chain."

Once again — because this is becoming Calif's signature.

August 2026: Calif used AI to reverse an Apple security patch into a working exploit for a macOS screen-sharing vulnerability. Note the direction of that attack: not finding a zero-day, but taking Apple's own fix and weaponizing the patched vulnerability it describes. Heise notes the technique is spreading — an independent exploit for that same screen-sharing bug surfaced soon after, apparently not from Calif. Any attacker with the right prompts can now attempt this, though Heise cautions that the best security-focused LLMs remain restricted to select companies and researchers; open-weight models are the exception anyone can touch.

September 2026: Calif built WeWorm, a self-spreading proof-of-concept worm that hijacked WeChat accounts through unanswered phone calls — zero interaction from the victim, the account taken while the phone was still ringing. Per the New York Times' September 8 report, CEO Thai Duong said the project would have taken months with a larger conventional team; AI compressed it to about a week. Outlets including Quartz and The Next Web, citing the company, report the timeline in more detail: roughly two days for the team, working alongside AI, to identify the vulnerability and produce an initial remote-code-execution exploit, plus one more week to build the complete worm.

AI analyzing code for vulnerabilities — the workflow behind modern exploit development

Do the arithmetic on that curve. A full exploit chain against current-gen Apple hardware used to be a months-long, six-or-seven-figure, multiple-researchers undertaking — the kind of capability that justified spyware vendors charging governments per-target fees. If AI-assisted research is now compressing that to days-to-weeks for a small team, the supply curve for nation-grade attack capability just bent. And it bent for everyone, not just for the good guys. Heise's conclusion is blunt: attackers could follow suit.

Heise also offers a specific, clearly-labeled speculation about how the iOS bugs may have been found: comparing iOS 27.0.1 with the current 27.2 beta — if the beta already contains fixes, the diff would reveal the vulnerabilities. Apple hasn't published documentation making that easy, and Heise notes the search "would presumably require a lot of tokens." It's an unproven theory. But it's exactly the kind of grind that AI is good at, and the fact that it's even being proposed as plausible is the point.

The Four Demos: Signal, iMessage, Root, and "Apple Persistent Threat"

Calif's newsletter post — the primary source — is famously terse. It lists four items, links four videos, and ends with one sentence: "Everything will be released in due time."

  1. "Signal 1-click" — a one-click compromise of the messaging app most trusted specifically because it has never been trivially compromised. Note the irony E2E-encryption advocates were quick to point out on HN: if the exploit path is the operating system's rendering or messaging plumbing rather than Signal's crypto, then Signal's math can be perfect and its users still owned. Community debate on the exact vector is unresolved — one popular theory says the Signal demo rides the system's PDF rendering stack, though kocpc notes Signal doesn't ship built-in PDF rendering code, so the theory doesn't cleanly hold. Unresolved, and Calif isn't saying.

  2. iMessage — introduced with the sneer quoted above. Because iMessage is the default, a working iMessage attack is effectively an iPhone attack. Unverified attendee accounts, which Glitchwire explicitly could not independently verify, describe a booby-trapped PDF that, when opened on iOS 26.5, sent the device's messages to an external server. Treat that as rumor with a quorum, not fact — the version discrepancy alone (26.5 vs. the 27.0.1 demo device) leaves the details murky.

  3. "Can your iPhone do this?" — the untethered jailbreak itself, shown live.

  4. "APT stands for Apple Persistent Threat" — the punchline, and honestly, the thesis. In security jargon, an APT is a well-resourced, persistent adversary — the term of art for state-scale hacking operations. Applying it to Apple's own platform, on Apple's current OS, at an Apple-relevant conference, is the whole argument in four words: persistence on iPhones is no longer hypothetical, and the vendor most famous for security marketing is the one being framed as the threat surface.

There's a plausible connective tissue between demos 1–2 and the wider discourse. On September 30, Calif researchers Dion Blazakis, Josh Maine, and Anna Groza published an analysis of CVE-2026-86950 — a CoreGraphics vulnerability, credited by Apple to Meta Product Security, in which a unit-conversion error triggered by malicious fonts inside PDF files causes an out-of-bounds write. Calif demonstrated proof-of-concept crashes on both macOS and iOS, and noted separately that crash-to-code-execution is its own work. They also observed that new PDF-scanning code appeared in WhatsApp around the same time — which they described, carefully, as circumstantial evidence that chat apps' PDF paths may be a delivery vector of interest. Whether the Hexacon demos used this same flaw or something else entirely: unknown. Calif has not said, and nobody else has confirmed.

The One-Two Punch: Citizen Lab, Then Calif, Twenty-Four Hours Apart

Here's the timing detail that elevates this from "impressive demo" to "generational moment," and it's the thing I keep coming back to.

On October 15, the University of Toronto's Citizen Lab published Report 195: "Exposing AdFection" — the first public technical confirmation of zero-click mercenary spyware delivered via targeted advertising. The mechanics are exactly as bad as they sound: an Israeli-registered ad-tech company called Discover-Tech, operating a platform the Lab calls Controlium, used the machinery of real-time advertising auctions to fingerprint and de-anonymize targets, then automatically infect devices the moment an advertisement rendered. No click. No attachment. No user error. The lab analyzed four billion bidding records; found Discover-Tech ads served on almost 200,000 unique websites and apps across dozens of countries in a four-month window; and documented devices at Al Jazeera infected with spyware from Candiru (rebranded, in a fit of optimism, as "Integrity Labs"). Google, IAB Europe, Beeswax, Vungle (Liftoff), and Eskimi have since disconnected Discover-Tech from the ad ecosystem, per the report.

One day later — October 16 — a private company stood on a Paris stage and demonstrated the full attack class that spyware vendors build their businesses on: one-click messaging compromise, and root persistence across reboots, on the newest iPhone, on the current OS.

The two events are not formally connected. Calif has never claimed to work with spyware vendors, and describes itself as a defensive company that builds attack tools to improve security. (That's also what the NYT reported about their posture with WeWorm — Thai Duong told POLITICO's Digital Future Daily that the company alerted Chinese companies to the WeChat bug, and that the US administration didn't try to dissuade them.) But capability-wise, they've now been publicly demonstrated in the same week by different actors with different motives, and that convergence is the story. The remaining "well, spyware is expensive and only governments have it" comfort blanket just got thinner. The remaining "and it takes them months" comfort blanket — per Calif's own CEO — is gone.

WIRED, covering the Citizen Lab work, called ad-delivered zero-click spyware a "nightmare scenario". It's hard to argue. When infection can ride an ad impression, "don't click suspicious links" stops being security advice and becomes a talisman.

What Apple Isn't Saying (and What Happens Next)

Apple, characteristically, has said nothing. The company typically doesn't acknowledge vulnerabilities until a patch ships, and there's no indication yet whether the bugs Calif used were previously reported to Apple through a bug bounty or coordinated disclosure. kocpc's survey of the community's most-asked questions under the X thread reads like an interrogation of the disclosure vacuum:

  • Does Lockdown Mode stop it? Asked repeatedly. Calif answered: nothing. Lockdown Mode disables message attachments and link previews — precisely the surfaces the Signal and iMessage demos appear to ride — so in theory it helps. Without technical details, nobody can promise it.
  • Was it reported to Apple? And will the bugs go public? Calif's entire public posture is "everything will be released in due time." No timeline. The community's running guess is a standard 90-day coordinated-disclosure window, but that's inference, not confirmation. Notably, kocpc reports people in the jailbreak community are already floating a Patreon.
  • Does it work beyond the demo device? The demo was iPhone 18 Pro on iOS 27.0.1. Support for other models, other chips, or iOS 27.2 is unknown. (We're deliberately not repeating the one line in kocpc that names a specific chip — it conflicts internally with the demo device, and nobody else corroborates it.)

The next scheduled iOS release, iOS 27.1, is in beta now. When it ships, the community will diff it against 27.0.1 within hours — and if it contains the fixes, those diffs become the vulnerability documentation, which, as this week has already demonstrated twice, is now a much more dangerous artifact than it used to be.

⚠️ Limitations & Caveats

  1. No public exploit exists. Calif released no code, no tool, no technical writeup. Every capability claim rests on a live stage demo — very convincing, but not independently reproducible until "due time" arrives.
  2. The everyday-risk math hasn't changed yet. For the average iPhone owner this week, nothing is different. Spyware-class attacks are targeted at specific people, not sprayed at everyone — Citizen Lab's AdFection victims were chosen individuals at Al Jazeera, not the general public. The structural story (capability timelines compressing, delivery surfaces widening) is what should reprice risk, not panic about your personal device today.
  3. The unverified rumors are swirling. The PDF-on-iOS-26.5 iMessage story is attendee hearsay that Glitchwire couldn't verify. The "Signal rides system PDF rendering" theory doesn't survive contact with Signal's actual codebase, per kocpc. Keep those buckets separate from what was actually demonstrated.
  4. Calif's incentives are complicated. A security firm that builds weapon-grade demos, doesn't publish details, and hints at future releases is... also running a marketing operation. The demos are credible because of the team's track record, but the release schedule serves the company, not the public. That's legal, normal, and worth naming.
  5. "First untethered since iOS 9" is an approximation. It's Glitchwire's characterization ("by several accounts"), and jailbreak historians will quibble about edge cases (semi-untethered tools, specific chip exceptions). The directionally true and verifiable part: nobody had demonstrated this on current Apple hardware and current iOS in about a decade.

🎯 The Bottom Line

The untethered jailbreak is the headliner, but the second-order fact is the real story: an elite small team, working with AI, turned a decade-long-impossible exploit class into a stage demo — and said it took about a week of work, not months. One day after Citizen Lab proved that ad networks can deliver zero-click spyware at auction scale. The question is no longer whether the newest iPhone can be fully compromised on current software. We watched it happen. The question is who else can now do it, how fast, and whether Apple's patch treadmill — about to be stress-tested by iOS 27.1 — can move faster than the machines that find the bugs.

📚 Sources

  1. Calif Newsletter (Primary/Gold) — "Today, we hacked what we'd set out to hack: the iPhone" — the four-demo announcement with video links. https://blog.calif.io/p/iphone
  2. Glitchwire (Silver) — "Calif Demonstrates Untethered iOS 27.0.1 Jailbreak at Hexacon, Hints at Signal and iMessage Exploits" — stage-demo detail, AI-attack track record, CVE-2026-86950 context, Citizen Lab linkage. https://glitchwire.com/news/calif-demonstrates-untethered-ios-2701-jailbreak-at-hexacon-hints-at-signal-and/
  3. Heise online (Silver) — "Works on iPhone 18 Pro: AI helps create untethered jailbreak for iOS 27.0.1" — AI role confirmation, patch-diff speculation, attacker-impact analysis. https://www.heise.de/en/news/Works-on-iPhone-18-Pro-AI-helps-create-untethered-jailbreak-for-iOS-27-0-1-11490907.html
  4. 電腦王阿達 / kocpc (Silver) — "資安公司在Hexacon展示iPhone 18 Pro完美越獄漏洞" — demo mechanics, team roster, community questions, jailbreak history context. https://www.kocpc.com.tw/archives/672311
  5. Citizen Lab (Gold) — Report 195: "Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware." https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/
  6. Hacker News (Community/Bronze, live via Algolia API) — front-page discussion, 956 points / 619 comments, story 50211474. https://hn.algolia.com/api/v1/search?tags=front_page
  7. The New York Times (Silver, background) — "A Hacking Tool Built With A.I. Can Breach Phones Without a Click" (Sept 8, 2026) — WeWorm reporting and Thai Duong quotes. https://www.nytimes.com/2026/09/08/us/politics/calif-ai-worm-wechat-hack.html
  8. WIRED (Silver, background) — "Nightmare Scenario: Zero-Click Spyware Is Infecting Phones via Targeted Ads." https://www.wired.com/story/nightmare-scenario-zero-click-spyware-is-infecting-phones-via-targeted-ads/
  9. Calif on X (Primary) — the Hexacon demo thread ("APT stands for Apple Persistent Threat"). https://x.com/calif_io/status/2111080250620661760

All claims verified against Gold-tier (Calif's own post, Citizen Lab's report) and Silver-tier (Glitchwire, Heise, kocpc, NYT, WIRED) sources. Each source URL was scraped and confirmed accessible on October 24, 2026. Unverified community claims are explicitly labeled as such. Last verified: 2026-10-24.

Back to Tech Minute
·