Apple iOS 27.0.1: Calif demos an untethered jailbreak with root on iPhone 18 Pro at Hexacon, alongside Signal and iMessage attack demos — bugs not disclosed and no Apple fix yet
Security firm Calif showed a series of iPhone attacks on stage at the Hexacon offensive-security conference in Paris on 16 October 2026. Its newsletter post lists four demos ('Signal 1-click', an iMessage demo, 'Can your iPhone do this?' and 'APT stands for Apple Persistent Threat') and says everything 'will be released in due time'. Stage video posted by jailbreak researcher Billy Ellis, as described by Decrypt, shows an iPhone 18 Pro running iOS 27.0.1 being rebooted, unlocked with its normal passcode, and an SSH session opened as root with about two minutes of uptime, so root access came back on its own after the restart with no computer attached (an untethered jailbreak). heise online reports the chain works on versions up to iOS 27.0.1, Apple's latest public release, and that AI helped find it. Calif has not named the vulnerabilities, released a tool or published a write-up; there are no CVE IDs, Apple has not commented and no fix has shipped. No exploitation outside the demo has been reported. Primary: Calif newsletter (16 Oct); context: heise online and Decrypt.
- Product
- Apple iOS / iPhone (demonstrated on iPhone 18 Pro); Signal and iMessage demos on iOS
- Versions
- Demonstrated on iOS 27.0.1 (latest public release at the time) on iPhone 18 Pro; heise says it works on versions up to 27.0.1. Fixed version: none yet.
- CVSS
- Not assigned — vulnerabilities not disclosed
- Exploited in Australia?
- unknown
- Patch to
- No fix yet. Keep iPhones on automatic updates and install the next iOS 27.x security release as soon as Apple ships it. Until details are public, high-risk users (executives, journalists, government staff) can turn on Lockdown Mode, and organisations should keep MDM compliance rules that flag devices behind the latest iOS.
Primary: Calif — iPhone: demos revealed at Hexacon Paris (16 Oct 2026) · Vendor: Apple — Apple security releases (watch for the iOS 27.x fix) · heise online — Works on iPhone 18 Pro: AI helps create untethered jailbreak for iOS 27.0.1 (16 Oct 2026)