Untethered iOS 27.0.1 Jailbreak Demonstrated on iPhone 18 Pro

Security researchers from the cybersecurity firm Calif have demonstrated a functional untethered jailbreak for iOS 27.0.1, successfully targeting Apple's latest iPhone 18 Pro. The live demonstration occurred at Hexacon 2026, an offensive security conference held in Paris on October 16. This event marks one of the earliest public instances of Apple's newest hardware and software being fully compromised, mere weeks after their release to consumers.

During the presentation, the researchers showcased the jailbreak's resilience by rebooting the iPhone 18 Pro. The device successfully booted to the lock screen, and the jailbreak automatically reactivated without requiring a physical connection to a computer. This capability defines an "untethered" jailbreak, signifying its ability to persist through a full system restart, a particularly challenging feat on modern iPhone architectures.

Following the reboot, the team established an SSH connection to the device on port 2222, gaining root-level access. Confirmation of this elevated privilege was provided by the id command, which returned uid=0. Further system details were revealed through uname and neofetch commands, indicating Darwin Kernel 27.0.0, an XNU version of 13432.2.10, and an iPhone model identified as iPhone19,2. The sw_vers command confirmed the operating system as iOS 27.0.1, build 24A446, with neofetch displaying 67 installed packages and an uptime of just two minutes.

Achieving root access on contemporary iPhones typically necessitates a complex chain of exploits. Attackers must first breach the application sandbox, then compromise the operating system kernel, and finally overcome hardware-based security measures such as Pointer Authentication Codes (PAC). Maintaining this level of access after a device reboot presents an even greater hurdle, as Apple implements checks on the code that executes during the startup sequence.

The specific vulnerabilities exploited by the researchers remain undisclosed, and no public tools have been released to replicate the jailbreak. Apple's iOS 27, released on September 14, included patches for over 120 vulnerabilities, with 20 of those affecting the kernel. This update was part of a broader security release that addressed a total of 273 vulnerabilities across various Apple devices. Earlier in the year, Apple also patched an actively exploited zero-day vulnerability in iOS that was used against targeted individuals.

For the average user, the immediate risk posed by this untethered jailbreak is considered low, given its non-public nature. However, the techniques employed in such exploit chains are often adopted by developers of sophisticated spyware. Therefore, iPhone users are strongly advised to install future security updates from Apple as soon as they become available to mitigate potential risks.

The demonstration at Hexacon 2026 highlights the ongoing cat-and-mouse game between security researchers and device manufacturers. While Apple continuously strengthens its security posture, the persistent efforts of jailbreak developers underscore the inherent complexities in securing modern mobile operating systems against determined adversaries.

This development serves as a reminder that even the most robust security measures can eventually be bypassed. Users should remain vigilant and prioritize timely software updates to protect their devices from emerging threats and vulnerabilities.