iOS 27.0.1 Untethered Jailbreak Demonstrated on iPhone 18 Pro
Researchers showed an untethered iOS 27.0.1 jailbreak on iPhone 18 Pro at Hexacon without releasing it.
Researchers from cybersecurity firm Calif demonstrated a working untethered jailbreak for iOS 27.0.1 on an iPhone 18 Pro at Hexacon 2026 in Paris on October 16. After a reboot, the jailbreak returned without a computer connection; SSH on port 2222 yielded uid=0, and system details showed Darwin kernel 27.0.0, XNU 13432.2.10, model iPhone19,2, and build 24A446. The researchers did not disclose the bugs and released no public tool. Apple shipped iOS 27 on September 14 with fixes for more than 120 vulnerabilities, including 20 in the kernel.
- Calif researchers demoed the jailbreak at Hexacon 2026 in Paris.
- Access survived reboot and provided root over SSH on port 2222.
- The device ran iOS 27.0.1 build 24A446 on an iPhone19,2.
- No vulnerability details or public jailbreak tool were released.
- Apple’s September iOS 27 release fixed more than 120 flaws, including 20 kernel issues.
Full article410 words · extracted from cybersecuritynews.com · click to collapse
Security researchers from the cybersecurity firm Calif demonstrated a working untethered jailbreak for iOS 27.0.1 on Apple’s newest iPhone 18 Pro.
The live demo took place at Hexacon 2026, the offensive security conference organized by Synacktiv in Paris on October 16. It is one of the first public signs that Apple’s latest phone and software can already be fully opened up, only weeks after both reached users.
On stage, the researchers restarted the iPhone 18 Pro. It booted to the Apple logo, reached the lock screen, and was unlocked with the passcode. The jailbreak then came back on its own without the phone being connected to a computer.
This is what “untethered” means. The jailbreak survives a full reboot, which makes it the hardest and rarest kind to build on modern iPhones.
Next, the team connected to the phone over SSH on port 2222 and logged in as root. The id command returned uid=0, which confirms full root access. The uname output showed Darwin Kernel 27.0.0 built on XNU 13432.2.10 for the T8160 chip, with the model listed as iPhone19,2. The sw_vers command confirmed iOS 27.0.1, build 24A446, and neofetch listed 67 packages installed through dpkg with an uptime of only two minutes.
Getting root on a current iPhone usually needs a chain of several bugs. An attacker has to escape the app sandbox, take over the kernel, and get past hardware-backed defenses such as Pointer Authentication Codes (PAC).
Keeping that access after a reboot is even harder because Apple checks the code that runs at startup. The researchers have not shared which flaws they used, and no public tool has been released.
Apple released iOS 27 on September 14 with fixes for more than 120 flaws, including 20 in the kernel, according to its official security notes. It was part of a wider release that fixed 273 vulnerabilities across Apple devices. Earlier this year, Apple also patched an actively exploited iOS zero-day used against targeted individuals.
For most users, the risk is low for now since the method is not public. However, spyware makers often use the same type of bug chain, so iPhone owners should install Apple’s next security update as soon as it arrives.
Guru Baranhttps://cybersecuritynews.com
Gurubaran KS is a cybersecurity analyst, and Journalist with a strong focus on emerging threats and digital defense strategies. He is the Co-Founder and Editor-in-Chief of Cyber Security News, where he leads editorial coverage on global cybersecurity developments.