Calif's iOS 27.0.1 jailbreak survives reboot, challenging Apple's immunity claims on iPhone 18 Pro

Security researchers from Calif demonstrated a working untethered jailbreak for iOS 27.0.1 on the iPhone 18 Pro at Hexacon 2026 in Paris on October 16, according to Cyber Security News. The live demonstration showed the device rebooting and restoring the jailbreak automatically, marking a significant breach of Apple’s latest hardware and software defenses.

What does untethered mean for operations?

An untethered jailbreak persists across full reboots without requiring a connection to a computer, making it the rarest form on modern iPhones. The researchers restarted the iPhone 18 Pro, which booted to the lock screen and unlocked with a passcode before the jailbreak reactivated. This persistence complicates detection and remediation for security teams monitoring device integrity.

View the original post on X

How did they gain access?

The team connected to the phone over SSH on port 2222 and logged in as root, with the id command returning uid=0 to confirm full access. According to GBHackers, Heise reported that AI assisted in finding the exploit chain. Gaining root on current iPhones typically requires escaping the app sandbox, compromising the kernel, and bypassing hardware defenses like Pointer Authentication Codes.

Why is this significant now?

This demo challenges a claim by Cellebrite that iOS 27 could not be jailbroken on current physical devices. While earlier research on iOS 27 required physical access and broke Secure Enclave functions, this Calif demo ran on the latest public release without such limitations. No public tool or CVEs have been released, and Calif has not disclosed the specific vulnerabilities used.

What is the vendor response?

Apple released iOS 27 on September 14 with fixes for more than 120 flaws, including 20 in the kernel, according to its security notes. However, no patch for this specific exploit chain has been confirmed yet. Spyware makers often use similar bug chains, so the risk remains latent until Apple addresses the underlying vulnerabilities in a future update.

Questions to ask your suppliers

Teams should ask mobile device management vendors whether their integrity checks can detect untethered jailbreaks that survive reboots. Security operations teams need to determine if current monitoring tools can identify SSH access on non-standard ports or root-level command execution. Incident response leaders should verify if suppliers have updated their threat models to include AI-assisted exploit chains. Ensure procurement teams review vendor contracts for clauses regarding rapid patch deployment when new zero-days emerge.

What to do and how to stay safe: iOS 27.0.1

• Monitor logs for unexpected SSH connections on port 2222 or other non-standard ports on managed iOS devices.
• Verify device integrity by checking for root access indicators like uid=0 in system commands during routine audits.
• Watch for official security updates from Apple that address kernel or sandbox escape vulnerabilities.
• Review mobile security policies to ensure they account for persistent jailbreaks that do not require tethering.

Step-by-step guide: Browser Security Settings for Small Business Teams

General security guidance from the TechSec Feed newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Is there a public tool for this jailbreak?

No, Calif has not released a public tool, and no CVEs have been assigned or confirmed for this exploit chain.

Did Apple patch this vulnerability?

No fix has been confirmed yet; Apple released iOS 27 on September 14 with fixes for over 120 flaws, but this chain remains unpatched.

What device was used in the demo?

The researchers used an iPhone 18 Pro running iOS 27.0.1, build 24A446, at the Hexacon 2026 conference.