Security researchers from Calif (Calif.io) demonstrated a working untethered jailbreak on iOS 27.0.1 running on an iPhone 18 Pro.
They showed it live at the Hexacon 2026 offensive security conference in Paris on October 16, 2026. Heise reports it is the first reboot-proof jailbreak since iOS 9, and that AI helped find the exploit chain.
iOS 27.0.1 Jailbreak Demonstrated on iPhone 18 Pro
According to technical demonstration footage shared on X, Hexacon is organized by Synacktiv. On stage, the researchers rebooted the iPhone 18 Pro. It reached the lock screen and was unlocked with the passcode.
The jailbreak then restored itself with no computer attached. This is what “untethered” means: the jailbreak survives a full reboot. That is the hardest and rarest kind to build on modern iPhones.
The team then connected over SSH on port 2222 and logged in as root. The id command returned uid=0, which confirms full root access. Other output from the demo:
| Item | Value shown in demo |
| Kernel | Darwin 27.0.0, XNU 13432.2.10 |
| Chip | T8160 |
| Model | iPhone19,2 |
| OS version | iOS 27.0.1, build 24A446 |
| Packages | 67 installed via dpkg |
| Uptime | About two minutes |
International Cyber Digest summarized the demo as a root shell within two minutes of boot.
A root shell on a current iPhone normally needs a chain of several bugs. An attacker must escape the app sandbox, take over the kernel, and bypass hardware-backed defenses such as Pointer Authentication Codes (PAC). Staying persistent across reboots is harder still, because Apple verifies the code that runs at startup.
Apple shipped iOS 27 on September 14 with fixes for more than 120 flaws, 20 of them in the kernel, according to its security updates.
Cellebrite had written just weeks earlier that iOS 27 could not be jailbroken on any current physical device. It also said there was no reliable public jailbreak for anything above iOS 18. This demo challenges that claim.
Earlier iOS 27 research was narrower. The usbliter8 SecureROM exploit booted a jailbroken iOS 27.0 beta 2 on an iPhone 11 Pro. It needed physical access, DFU mode and special USB hardware.
It also broke features such as the Secure Enclave (SEP)-dependent functions, Wi-Fi and the baseband. The Calif demo differs in two ways: it ran on Apple’s latest hardware and on the latest public release.
Calif has not disclosed which vulnerabilities it used, and no public tool has been released. No CVEs have been assigned or confirmed. Heise noted that Calif’s X profile had no further details.
A post from ONE Jailbreak said the work would be released “in due time”. That is a secondary claim, not a Calif statement.
For most users the immediate risk is low because the method is not public. Spyware vendors often use the same kind of exploit chain, so the concern is wider than hobbyist jailbreaking.
Defenders should take precautions to protect their environments, including installing Apple’s next iOS security update as soon as it ships, enabling Lockdown Mode for high-risk users such as journalists, activists and executives, treating any tool online claiming to jailbreak iOS 27 as likely malware since Cellebrite warns that such tools are often malware in disguise, and watching Apple’s security release notes for kernel, sandbox and PAC-related fixes credited to Calif.
The key open question is whether the chain relies on a single patchable set of bugs or on something deeper. Until Calif discloses details to Apple and the fixes ship, the exploit’s scope is unverified.
I could not retrieve the X post you linked, so this article relies on the Hexacon coverage above.
