Apple rains on MIE-bypassing iPhone jailbreak parade with iOS update. Oct 29 2026 6:30AM Researchers get past anti-spyware memory protection. Apple's busy patch week includes iOS 27.2, which closes off most of the bugs security researchers exploited to "jailbreak" an iPhone protected by the company's newest anti-spyware hardware. A jailbreak removes the software restrictions Apple places on iPhones, giving users full administrator (root) access to the operating system. That lets them install apps from outside the App Store and change system files, which is normally a no-no for security purposes. While jailbreaks provide freedom for users to install the software they want, they can also expose them to malicious code unwittingly, which can access very sensitive information on devices people entrust their digital lives to. Jailbreaks have become harder to accomplish as Apple has heaped resources on making its devices more secure, but researchers from security vendor Calif recently demonstrated at the Hexacon conference in Paris that they could defeat the protections in iOS and importantly, iPhone hardware. Security vendor Calif's team was able to run an exploit chain to achieve a jailbreak. What's more, Esser and team rebooted the iPhone 18 Pro running iOS 27.0.1 and the jailbreak didn't clear out, but survived and was available afterwards. Esser and Calif's jailbreak got through Apple's hardware Memory Integrity Enforcement (MIE) protection that was introduced with the A19 chips last year. Calif followed up a week later, jailbreaking Apple's new iPhone Duo on its launch day, October 23, running iOS 27.1 via Signal and Apple iMessage. Apple's iOS 27.2 update, released on October 26, fixed most of the flaws involved, Calif researcher Stefan Esser said, and the security vendor was acknowledged for finding the bugs. Calif previously said Anthropic's Claude Mythos Preview helped it build a macOS kernel exploit against the MIE protections in Apple's M5 chip in under a week, Decrypt reported. The delivery route for Calif's jailbreak echoes FORCEDENTRY, the zero-click exploit Citizen Lab caught NSO Group's Pegasus spyware using in 2021, which abused a CoreGraphics flaw through crafted PDF files sent over iMessage. Calif has not linked its work to any spyware vendor, and has not published technical details of the chain. AI-assisted research features heavily in the iOS 27.2 notes, which credit Anthropic Research on three fixes and OpenAI on four. Apple said none of the 163 vulnerabilities fixed in iOS 27.2 was known to have been exploited. CoreGraphics gets updates, including for old iPhones Furthermore, Apple has also extended a fix for a separate, exploited CoreGraphics flaw to its oldest supported iPhones, four weeks after patching newer models. This is a practice known as backporting, as in adding updates for older operating systems, and the iOS 18.7.11 update covers the iPhone XS, XS Max and XR. Those devices, released in 2018, cannot run the current generation iOS 26 or 27 mobile operating systems. The update closes CVE-2026-86950, an out-of-bounds write that Apple said could allow arbitrary code execution when processing a maliciously crafted file. Apple said it was aware of a report that the flaw may have been exploited in "an extremely sophisticated attack against specific targeted individuals" on iOS versions before iOS 27. It was fixed for iOS 26 and macOS on September 28, but Apple released nothing for handsets limited to iOS 18, even though its warning covered every release before iOS 27.

Hackers jailbreak iPhone 18 Pro on stage, and it survives a reboot. Calif showed an untethered jailbreak on an iPhone 18 Pro running iOS 27.0.1 at Hexacon in Paris. It survived a reboot, but no tool or bug details are public yet. Oct 16, 2026 In brief. * Calif showed an untethered iOS 27.0.1 jailbreak on an iPhone 18 Pro at Hexacon in Paris on October 16, with root access returning after a reboot. * The firm has not named the vulnerabilities or released a tool, and says it will publish everything later. * Apple's iOS 27 security notes credit Calif.io, working with Claude and Anthropic Research, for two unrelated crash bugs; Apple has not commented on the demo. Security firm Calif.io demonstrated an untethered jailbreak on an iPhone 18 Pro running iOS 27.0.1 on stage at Hexacon, the offensive security conference in Paris, on Friday. It's the first time an untethered, permanent jailbreak is successful in such devices. A jailbreak strips away Apple's software restrictions, and untethered means it comes back on its own after a restart, with no computer attached. Apple builds the iPhone as a locked-down system, with signed code, a sandbox around every app and a protected startup chain, so owners cannot change how iOS works or run software the company has not allowed. A jailbreak breaks that lock and hands the user root access, which lets them install apps Apple never approved, add new features, customize the interface and use the phone in ways Apple did not intend. For example, back in the early iOS days, users with jailbroken phones were capable of filming video before Apple shipped that feature. They were also able to run Android on their iPhones, unlock carriers, install themes, and so on. Right now a user with a jailbroken iPhone can install apps outside of the Appstore, browse the full file system and delete bloatware. Few people do this today, but every working jailbreak on current hardware shows that the defenses Apple invests heavily in can still be beaten. Video from the stage, posted by jailbreak researcher Billy Ellis, shows the team rebooting the phone, unlocking it with the regular passcode and opening an SSH session as root, the highest level of access on the device. The terminal output listed iOS 27.0.1 and an uptime of about two minutes. Hexacon runs October 16 and 17 in Paris, so the demo came on the opening day of the conference. The event is aimed at researchers who find and exploit security flaws, and its talks typically cover bugs in widely used platforms such as phones and browsers. Calif has not said which vulnerabilities it used, and no public tool exists. Its newsletter post from the conference lists four demos, including a Signal one-click and an iMessage demo, and says everything "will be released in due time." Getting root on a current iPhone usually takes a chain of bugs that escapes the app sandbox, takes over the kernel and gets past hardware-backed defenses such as Pointer Authentication Codes, which detect tampering with memory pointers. Surviving a reboot is harder still, because Apple checks the code that runs at startup. In April, Calif's Thai Duong wrote that Claude helped him take apart an iOS Safari exploit, in a series on how a real iPhone jailbreak works. In May, Calif said Anthropic's Claude Mythos Preview helped it build a macOS kernel exploit against Apple's M5 chip protections in under a week. "We didn't build the chain alone. Mythos Preview helped identify the bugs and assisted throughout exploit development," he said. Bitcoin BTC · USD $81.611 −1.08% Oct 9 Oct 11 Oct 13 Oct 15 Oct 16 $84.2k $82.9k $81.5k $80.2k 24h High $82.816 24h Low $80.761 Market projections Odds by Myriad Buy Bitcoin with USDT Powered by Jupiter Apple's iOS 27 security notes, published September 14, credit Calif.io "in collaboration with Claude and Anthropic Research" for two bugs that let an app cause a denial of service or a system crash. Nothing in the notes ties either bug to the jailbreak. A chain that gives root on a fully updated iPhone is the same kind of capability that commercial spyware vendors sell to governments, and Apple usually patches such chains once it learns the details. How long iOS 27.0.1 stays exposed therefore depends largely on when Calif chooses to publish. Apple has not publicly commented on the demo as of Friday, and says it does not confirm security issues until patches are available. Calif has not said when it will publish the details. Start every day with the top news stories right now, plus original features, a podcast, videos and more. Join 72,000+ readers