Very cool demos, but now I'm interested to know: does enabling Lockdown mode help at all against these exploits? It'll theoretically protect against a lot of common attack vectors, but I'm curious about its real-life effectiveness.
These are still 1-click, not zero click. So the best protection you can have is not opening unknown files that were sent to you. That being said, lockdown mode blocks all sorts of message attachments. From the videos it look like they are using pdfs in the messaging vector, which would get blocked too. So you would be safe-ish. But lockdown mode is so restrictive that it doesn't really make sense for most users. Or at least it doesn't make sense to buy a $1500 phone and then limit yourself to something you could have gotten for $50.
You don’t know what lockdown is do you? I’ve had my phone in lockdown for a year. I can’t: collaborate on notes, and it does not automatically open links in chat. Other than that my experience is identical to non lockdown.
I use Lockdown Mode and the functionality I get is nothing like a $50 device. If you're being serious can you link to some $50 devices for sale that are on par with a recent iPhone Pro running in Lockdown Mode?
Subverting the secure boot/upgrade chain would require a SecureROM exploit and presumably a compromise of the Secure Enclave, so the answer is almost certainly "no" (even prior major exploits from recent memory like usbliter8 are tethered and don't exploit the enclave; the last true untethered Jailbreak was iOS 9 or something.) An upgrade would fix it. The internet reporting claims this break they are showing in this video is untethered though, which is extremely rare on its own.
The videos sort of imply that these are userland rather than bootrom, whatever payload they have running is getting hit before first unlock, which isn't a lot of surface. They specifically say to not update which pretty much confirms where the attack surface is. Somewhere after the kernel starts but before the main user space is unlocked with the passcode.
I want the freedom to install the OS I want on my phone. Now if I install a proprietary OS, I get what the developers of that proprietary OS choose to do. And if that proprietary OS does not give me root access, well, that's life.
I wonder if pdf.js would be more secure since it runs inside a webpage and can benefit from the browser sandboxing. Though I guess iOS has generally managed to keep most of its apps native rather than web app wrappers (as has happened on Windows).
LLM and full rewrite are a recipe for cooking something that still has flaws but also doesn't work that well. The root cause is that PDF is an old format from a more innocent era. A new document standard that keeps up with the technical and security advances, learns about the lessons PDF taught us, and allows for easy conversion from old PDFs, would be the ideal solution.
Who am I kidding, I think the PDF format will outlive us.
It’s a mix - for years I wanted root on my iPhones, just like you got on android. In practice, once I had it…? I never did much beyond installing Cydia.
With today’s hardware I might have a different take - the 18 has more than enough hardware to be a laptop so maybe I’d use it for a docking mode. But my gut is I’d probably still want a laptop even then.
To me the upshot is : billions of development, software and hardware, have gone into the platforms - it’s hard to quickly make them significantly better.
When I owned an iPod touch, the advantage of jailbreaking was to give your device certain features that the OS just didn't support. (Hell, I remember early days when iOS didn't even have a concept of wallpaper, the background was just black.)
iOS has come a long way since those days so a lot of the most common use cases of the past are no longer necessary. But the principle is the same - the hardware is a general-purpose computer but the software is locked down unnecessarily in many ways. Jailbreaking lets you do things that are outside of Apple's box.
The equalizer is easily 20 years old, and is restricted to presets. Presets! A parametric EQ is the only thing that can make Apple's own Powerbeats Pro sound good. And for several golden years (despite lots of Apple's work against it) we had a really good jailbreak equalizer that worked with Apple Music. Eventually I just gave up on the whole thing. But I remember going out for trail runs with good sounding music without worrying about losing my earbuds.
I jailbroke every iPhone I had for many, many years. Most of the time it was silly skins/tweaks but there were a number of things that were huge QoL improvements. I remember BiteSMS and using it as a way to reply to a text directly in the notification instead of having to leave the app. This was before iOS had that feature and before multitasking, back when if you left the game you were playing the app would quit. Also had folders before stock iOS, things like Control Center, and a whole slew of little tweaks for other apps I used.
The downside to jailbreaking was often the instability but that was also back when the phones were way less powerful. Today, armed with LLMs, I would love to have root on my iPhone again. I'd love to rip out Siri and replace it with Claude Code or something like that.
There's just less reason today for someone like me that liked the utilitarian benefits of a jailbroken iPhone. I used it for gestures, caller mini preview, grouped notifications, etc. All things that are now baked in.
I'm for being able to hack your own device to do whatever you like with it, preferably without active resistance from its manufacturer. I'm against anybody who can convince you to open a PDF being able to hack your device to do whatever they like with it.
The point the parent commenter is making is that they want Apple to allow people the freedom to intentionally mod the functionality of their device. Not that they literally want single-click PDF exploits to be a thing.
What in these videos is so much cooler than what you can do on an Apple approved one? Other than, "As a programmer, I can do anything", I just personally don't see any capabilities unlocked that I can't have with an app or whatever. But I might be missing something.
The only thing I really miss from my jailbreak days is an app that could talk to the cellular baseband and display all cell towers nearby on a map and showed which you were using.
I used to have my home screens fully customized but that’s a lot of work creating icons for hundreds of apps. Or even dozens.
I watched the “Can your iPhone do this?” video, assuming that was the coolest one. The others seemed like they’d just be showing the exploit.
It seemed like a silly party trick with no practical purpose, and required the terminal to reset things back to normal so the phone was useful again. Why does anyone want this? Surely there are better uses than what was demoed?
I used to jailbreak during the first few years of iPhone. I remember being able to drag out from the bottom right corner of the screen to have a launcher, similar to the Dock, but with more stuff. But over time, the iOS got more features and the argument for jailbreaking became less compelling. This is especially true now that so much sensitive information is in our phones… so I trust all this stuff that effectively has root?
Noob q: Does this(and most) hacks like this on the iphone likely rely on some kernel module — or what it talks to for executing code — being compromised to run arbitrary code execution? I dunno about ios but it seems from the videos that something that reads imessage attachments was compromised for privilege escalation.
Like what im mean is an attack vector shaped similar to https://pepsipu.com/blog/2026-10-switch2-jailbreak-ns2jb/ i.e. they compromised `fs` module that did not protect against a buffer attack(in memmov)? My understanding is that most core kernel modules are difficult to attack directly because of XOM, PAC and CFI like protections make it impossible for anyone/thing, so most likely only indirect attacks like above can work in such situations — there is a lot of incentive for teams like apple to do everything possible to improve security so i assume only these kind of difficult to find vectors remain.
hacks like these, where you go from a PDF to full persistence, require a chain of exploits. Pegasus, the iOS malware that made the news awhile ago, used a chain of 3 exploits like this:
I can 100% guarantee that we'll have comments from people saying they buy iPhones specifically because of the walled garden and the last thing they want is a jail broken device. On a website called Hacker News.
yeah it's kind of weird because some old mac laptops I've used were easy to work with and put on third party software (Linux), but the things like ipads and iphones not so much...
edit: it's like... just give us the same option for the ipads / iphones please?
I just feel a bit sad and impotent that a number of security researchers outside the circle cannot join their "yo we found more crazy bugs" party because simply frontier labs only give access to those models with "Red Team" availability to the inner circle members/companies.
Now their "trusted cyber access" program is moat rather than safeguard.
Not in my experience (yes, sample ~= 1), where they are subpar in terms of cybersecurity (e.g. source code review). This is one of my reports using GPT 5.6 (High), GLM 5.3 High, Fable 5.1 [1]:
> On the full benchmark of 31 audited revisions, GPT-5.6 Sol High reached a weighted recall of 38.27% and GLM-5.3 High reached 30.86%. On a common subset of 12 projects, Claude Fable 5.1 High reached 65.70%, against 42.98% for GPT and 35.54% for GLM.
Anything you can find with an LLM to break into a locked device/ecosystem, the operators of that ecosystem can find with an LLM too, and fix it. Right?
Only if it's in updateable software. Hardware takes longer to correct.
Hence Sam Altman's latest public comment: "I don't even know a dramatic enough word to use… models can find bugs that are outside of the normal threat model of what we think a hacker can do… hardware-level, insane stuff… I no longer think we're gonna be able to just patch all the bugs."
This is true for things other than LLMs. Outside contributors have been credited with hundreds of security fixes to macOS and iOS that were found with fuzzers and sanitizers. Just off the top of my head CVE-2019-8605. Clearly, Apple has access to AddressSanitizer and libfuzzer, but outsiders still find these things. Not only Apple: Google can find flaws in iOS but outsiders also find flaws in Chrome, so the phenomenon is widespread.
I'm continually amazed that PDF has survived this long while so many other technologies have died. Not only is it a constant vulnerability, but it's not even good at its job. Absolutely miserable UX and DX.
It’s a pity we gave in to the “ecosystem” play by these huge companies.. even if I jailbreak my iOS and never let it update.. Apple can easily detect the jailbreak and lock me out of anything iCloud, and iMessage and such. iPhone would be one glorious iPod touch after that.. :-(
Seeing all these gives me the same energy of early days of jailbroken Android phones where one could become root and do whatever with the hardware…
I stopped considering such tinkering because I got tired of finding those little tweaks and fixes on forums like xda every time something was updated. With the LLMs capable of automating that tool, I might find those old school way of mobile phones again…
I’ll vote with my vote thank you. My table’s manufacturer shouldn’t get a say in what I put on my table, and Apple shouldn’t get a say about my phone either.
These clearly anti-consumer practices should just be illegal.
This comment made me think that someone should pull an ArtCraft on Android or iOS by making a good linux phone skin, with high performance auto-updating wrappers for various web apps to make them as convenient as mobile native ones. Then we can actually ditch the big corps and bask in our LLM-enabled open source utopia. Hmmmmm.
Give it another 6-12 months until the big AI shops shut those capabilities down and running local ones becomes cost prohibitive
I don't expect that to happen, but I do expect Apple et al to spend trillions of tokens hardening their platforms against users and red-teaming to find these sorts of holes before release.
The loss of your purchase is insignificant compared to the money Apple and Google make from their walled gardens.
Plus what other viable options are there in this duopoly?
Apparently there’s a popular 3rd option in Asia but is there any support for western apps? And how are you going to convince a million other people to switch?
Many Android phones are not unlockable without hacking. They use cryptography to protect the bootloader and to get the unlock code for your own phone first you need to provide them all your information.
Where would you point said wallet? Google isn't far behind Apple on this from, ahead in some ways, and many (all?) of the FOSS Linux powered phones cost even more than iPhones do.
Easier said than done. Because, "Apple can do no wrong" is the general public perception. Look at any wrongdoing by Apple - whether they were caught slowing down the phones, degrading cameras on purpose or even the lawsuit where they were caught spying on people's voice recordings. There will always be some NPC defending them as if the billion dollar corporation gives a shit about them.
That or "Apple is the only pro-privacy company in the world" despite there being an active lawsuit against them for the exact opposite.
So, I say: Vote with your wallet. Fuck them...and the fanboys.
How are running local ones going to become cost prohibitive? Indications are that Nvidia has been channel stuffing (artificially inflating perceived demand), which suggests massive oversupply of GPUs.
> even if I jailbreak my iOS and never let it update.. Apple can easily detect the jailbreak and lock me out of anything iCloud, and iMessage and such.
As someone who's been jailbreaking since the iPhone 3GS (and held onto a iOS 17.0 device for the longest time), Apple has never bothered to detect jailbreaks and lock people out of iCloud and iMessage.
If anything, it's those sleazy security framework providers that provide jailbreak detection to apps and cause them to either lock people out of accounts and features, or crash entirely.
Some government-mandated audit processes (at least, that's what I understand here in Singapore) also require jailbreak detection.
> Apple has never bothered to detect jailbreaks and lock people out of iCloud and iMessage.
Not entirely true. It absolutely has in the case of the Hackintosh. In fact many a year ago that’s what inspired me to get my first Mac, because every release of macOS made it harder and harder with custom bootloader and kexts to get around Apple’s active efforts to ensure you couldn’t use those unless you were on an actual Apple device, not just running their OS.
> I stopped considering such tinkering because I got tired of finding those little tweaks and fixes on forums like xda every time something was updated.
Several vendors sell Android devices that allow bootloader unlocking, Pixels being the most known.
Once unlocked, Magisk is the current and most used rooting tool.
Oh man, those early days of XDA forums and SenseUI roms on my NexusOne. Those were truly a thing of beauty. We still haven't gotten back to that level. I'm with you though, I stopped playing and moved to a stock device. Then I moved back to an iPhone and have been completely stock ever since. I haven't been excited about an iPhone since the 10 released. After that I think, "oh cool, another rectangle". "A grid of icons"... "The best camera Apple's ever put in a phone.... how wonderful".
There have been several companies that tried to sell open mobile devices over the years, but people have shown time and time again that they don't want to buy that product. We can wish it were different all we like, but in general we aren't entitled to money-losing, unmarketable products.
> Apple can easily detect the jailbreak and lock me out of anything iCloud, and iMessage and such.
Don't sign into any of Apple services then! Just use it as a pure developer playground or create an alternate ID. Can't be looking for everything everywhere :-)
> even if I jailbreak my iOS and never let it update.
Two things:
a) Why the would you never want to update an OS in this day and age ?
b) I understand the perspective of people insisting on wanting to be able to root their phone. But how about we take a step back and look at the reality of the 2026 security environment ? An environment where you have:
- Increasing volumes of increasingly sneaky security exploits on one side
- A phone with your 2FA apps, your banking apps, your email apps, your kids photos on the other
Frankly. I want Apple to lock down my iPhone as much as possible in that context.
If I want to be root, I can do so on my desktop or a cloud VM or whatever.
But making root on a phone easy just seems like a recipe for disaster... if its easy for you, its easy for the bad guys too.
> a) Why the would you never want to update an OS in this day and age ?
Because updates break the jailbreak. If Apple actually had a sanctioned way to let you do what you want with the device you bought there would indeed be very little reason to not update.
I’ve never used iCloud. I hate Apple but I hate Google more. Instead of iCloud I use WebDav, CalDav, Bitwarden and NextCloud. Contacts, calendar, passwords and photos that I control. I recommend the same to others but I can count on one hand who has actually gone away from iCloud into such a setup.
We gave in because open source and hobbiests do not design good products and even worse shared systems, as much as they enjoy self-righteously declaring their values. And shared systems require trust, planning, and goal setting in a way no open system would ever build.
1) They of course lack the resources
2) Often lack professional displince across all skills required
3) Mostly make for themslves or whats interesting, not whats needed.
> open source and hobbiests do not design good products
This is opinion. In my opinion, closed products are not good products. To me, openness and freedom trump subjectively better UX any day.
> as much as they enjoy self-righteously declaring their values.
Consider that in our society and software ecosystem, this is all but required to stave off the forces that would enclose the software commons that these "self-righteous" volunteers work so hard to maintain.
This seems more correlated with big vs. small organizations, not closed vs. open organizations. There are open projects (e.g., Debian, Blender) that tick all four of your boxes in my opinion.
You do understand the reasons right? iCloud, iMessages etc are an interplay of software in your device, software in cloud and some networking. They have to work together. A jailbroken phone can have a tinkered iMessage app. Supporting tinkered / unsupported versions is more overhead / possible security risk. Why would you expect them to take on that?
I agree with your point, though I can easily modify ~/Library/Messages/Attachments or ~/Library/Containers/com.apple.MobileSMS/Data on macOS, which is a platform similarly secure to an iPhone when you take sandboxing, sip, etc. into account. So Apple already supports macOS, which can be tinkered, no? I guess the argument is that by locking down iOS, a platform which was never open, they just never needed to handle that class of security risks which are introduced when customers have more freedom.
I did actually discover a bug in iOS (related to photos which have failed to sync to icloud for the past four years) by investigating why there were over 23k empty folders in ~/Library/Containers/com.apple.photos.ImageConversionService/Data/tmp/, fwiw.
A reminder for people who don't follow this, Calif is Thai Duong's firm. Thai discovered the BEAST and CRIME TLS attacks (with Juliano Rizzo), and then worked at Google for a bunch of years, including on Wycheproof with Daniel Bleichenbacher. The team at Calif includes lcamtuf, Dion Blazakis, Tavis Ormandy, and Stefan Esser (among many others).
They're basically the most interesting team working in vulnerability research right now; a cross product of ludicrous talent and full-tilt AI work.
Just before I left Fly.io a few months ago, we retained Calif for an annual pentest (we'd previously worked with Tetrel, Atredis, Doyen, and I think Include?). They were spooky good. Everybody we'd worked with was good, but Calif's results were unusually high-impact.
There are loads of these exploits which exist in the hands of private hacking groups and state organisations which have not been made public. Always assume your device is able to be compromised from those who have the motivation and dedication.
Is it an exploit around the library that handles PDF parsing/opening? Can someone explain how files / attachement are open on a mobile device ( android/iPhone).
I don't understand how in 2026 this is still a thing, we have many safe languages to parse/deserialize data. Why is it complicated?
PDFs are basically executables, that's why it's hard. They support running code, they support decoding images which themselves have their own custom compressors that are basically code. Anything to do with image formats is rife for bad decoders, insane compression algorithms from the 90s, and a PDF is basically 1000 formats inside many different container types with executable code plastered on everywhere. If you want to make a compatible PDF viewer you'll need to be able to implement an image decoder algorithm for a fax machine that was specific to Japan in the late 80s, which was somehow ratified into a standard and is used today by all the top legal firms, or something absurd like that. When you open a PDF on your computer, depending on how it is being parsed, it can even make outbound network connections without you knowing. To safely open a PDF you need one of those bomb proof suits, a disposable laptop, and even then you might be going home without eyebrows.
Willing to bet that a default "treat PDFs/documents/spreadsheets as dumb" option in operating systems would eliminate the majority of common one-click vulnerabilies out there. And exactly 0.001% of actual use cases would be affected.
That isn’t really true, it’s not hard for PDF viewers to block by default (or just not implement) the problematic features, which also aren’t critical for the vast majority of PDF files.
The exploitable bugs are typically the usual, some buffer overflow in an underlying image or font library or similar, but unrelated to PDFs being “executable”.
From the standpoint of a layman it looks like there's a lot of overlap between writing safe web browsers/engines and writing safe PDF readers/engines. There just hasn't been anywhere near as much of an impetus to push PDF readers/engines in that direction because most of us aren't interacting with PDFs nearly as often as we interact with the web (and things built on web tech).
I'm pretty sure not even the safe languages would help you here. PDF allows you to pretty much run arbitrary code since it supports javascript, images, and a bunch of other things I'm forgetting, and you can't not implement javascript support or otherwise be selective about what you support with it because then all the end-users will complain when they get that one PDF that they need to fill out but it needs JS because... Nobody knows.
Cool to see our work here. I'm Thai, and I run Calif. Happy to answer any questions.
We'll publish the technical details of these hacks over the coming weeks. Writing these articles takes time, and we've been busy with a PHP thing [1].
In the meantime, check out The Great Glyph Grift [2] for a glimpse of what can go wrong when iOS parses PDFs.
Just in case you wonder, we've disclosed most of the bugs in these exploit chains to Apple and will disclose the rest. So far in 2026, we've reported close to 100 bugs to Apple. We don't accept Apple bounties, and we're not being paid for this work. We don't sell bugs or exploits, and we have no sponsors funding this research.
We do this because it's fun, intellectually challenging, and we want to help make the iPhone safer. We also have a business to run, so we do need some marketing points.
Hey Thai- How much of the at Calif is managing agents to explore ideas? Are ideas coming from agents themselves or still human generated, and has that changed since y'all started the company?
On the cost side- How expensive is it to develop each of these demos w.r.t. inference cost? Are y'all purely using OAI/A\ cyber models or are there OSS models being used too?
I'm not sure if this is real, but if it is: this week is unbelievable. I really hope it's not the new normal, but unfortunately I don't believe this myself.
If this continues I'll argue that you have to be absolutely insane to allow network connected electronics into your home in the future. This is Apple, known for locking down their device to the extreme, and yes some people would love to use this for jailbreaking their phones, other organisations want to root your phone for .... other purposes.
Insecure webpages, broken certificates and an insecure PDF library... You shouldn't have anything more connected than an FM radio at this point. Security is no longer something a private individual can deal with.
There's every incentive for nation states and other espionage outfits to keep these types of exploits under wraps. This has probably been the new normal for some time ..
I for one have experienced multiple lifetimes worth of internet madness and will be looking to airgap / disconnect as many devices as I can get away with.
People have been paying a premium to companies like Apple for a reason. You've got nothing to worry about.
Decade of people's purchases has been invested into safety and security. It's absolutely unthinkable that a $7t market cap company with an army of 200k workers will ever leave people high and dry. They proudly went public, so we know they have the public's interests at heart.
I think in time (a few years) the gap will close a bit. As AI is used to harden software, it will be harder to break. Software not validated by AI will continue to be vulnerable to it.
So what happens if AI becomes something that you need to actually pay real money for? Then only Apple, Google and Microsoft can affort to do network exposed software. Smaller companies and solo developers are just f-ed if the price of running LLMs goes up as investor money dries up.
It would make me so happy if this would allow running UTM.app with Hypervisor support on iPadOS. I don't want to travel with two devices, the would be enough, but sometimes I need a real desktop. Apple, of course, wants you to buy two devices. I do have UTM with Jit Linux running on my iPad, via altstore and entitlements and so on, but it is all a bit complex and still fairly slow.
My favourite part from the first video is how much effort it took to drag up from the bottom of the screen to get back to the home-screen. This reflects my experience with how iOS handles touch gestures in general.. also super easy to accidentally activate "Reachability" mode!
> They are going to run out of vulns eventually when the code is rewritten in a memory safe lang
that's just not how it works at all though is it. Good luck writing the kernel, firmware etc in a completely memory-safe way. And even if that was accomplished, memory safety isn't the only class of vulnerabilities, it's just the most common.
> and the rest are found
If they kept a stable version with no updates or new features *ever*, only security patches, for decades, then maybe that could be possible, yeah. But Apple users aren't exactly the kind of people who would enjoy such stability and security anyways, it comes with the compromise of novelty. Stability and security aren't very fashionable either.
edit: Obviously a "memory-safe way" means no `unsafe` blocks in Rust, too.
edit#2: This is all assuming we don't get true AGI. I hope my assumption is right
Aside from bragging how cool they are, what value is there for demonstrating a yet-to-be-patched vulnerability? I don't understand why old-guard infosec stars from Calif can do as they want, responsible disclosure be damned.
Just as a reminder for some folks here: During their WeWorm research in July–September 2026, Calif didn't stop at proving RCE to Tencent—they spent an extra week using AI to build a fully functional, self-propagating zero-click worm across three live phones, triggering temporary account bans from Tencent during testing.
I don't see this as irresponsible disclosure. They show that the vulns exist, but don't give any other details (unlike previous Calif releases). Not even a hint at what the exploit chain is like other than that it starts with a PDF, which is a surprise to no one.
They're of course also doing it for internet kudos, but attracting attention like this will help encourage people to update. Thanks to this article, I'm going to apply the next iOS security update ASAP, and tell everyone I know to do this the same. (hopefully it comes out soon)
I do wish they clearly stated the vulns have had been reported to Apple and when.
We disclosed most of the bugs used in these chains to Apple, and are going to disclose the rest, if not already.
>Just as a reminder for some folks here: During their WeWorm research in July–September 2026, Calif didn't stop at proving RCE to Tencent—they spent an extra week using AI to build a fully functional, self-propagating zero-click worm across three live phones, triggering temporary account bans from Tencent during testing.
Not sure what exactly your point is. The WeWorm demo was done in a controlled environment.
Also we do this for free. We don't charge neither Tencent nor Apple. We don't even take their bounties. Why can't we have some fun?
If you're so upset about how we do it, my suggestion is go find your own bugs.
You literally just said your company released an exploit demo before disclosing some of these vulnerabilities to the vendor.
As for your suggestion, I was an infosec researcher, I worked for 3 years with vendors to help them patch before I can even tweet anything about my research. I even flew to their HQ to assist in patching when needed. After Covid I transitioned to a development role, and now I'm on the other end, handling security reports from researchers.
Based on this dual point of view, let me tell you that for a security engineer in Apple that will learn from your video about vuln your company did not even disclose yet, this karma harvesting is as far from "coordinated disclosure" as possible. Their managers will be fuming, and the stress they will be in given the media frenzy will be off the charts.
What is the value of revealing anything at this time point, when no patch is out? What use is it for the public?
Just last Black hat there was a "glimpse disclosure" that was later followed with proper fixes and details. I gave my AI agent the details that were supposed to be "useless", before the patch was out, and it found the vulnerability in less than an hour.
We shouldn't even enter this game. And with the track record of this specific group, I didn't exactly get the impression that their incentive is to help fix things, but rather to promote their brand while others be damned.
A couple of PDF exploits from iMessage and Signal leading to code execution, and an app that roots the phone. Also, they seem to have managed to make their malware survive a reboot, which is difficult. That's another reason why automatic reboots are considered a security feature: exploits leaving malware in-memory are a lot easier to build than malware that survives a full reboot, passing all stages of signature checks and validation.
Yes, why don't they just say it instead of posting videos. Opening a sinister PDF in iOS can give them access to what exactly? anything/everything? What iOS versions or devices, etc?
This post gave me flashbacks to jailbreak era w/ Cydia. It's interesting to think that a lot of the those old plugins and tweaks have basically become standard supported features of the iOS now (SBSettings, Activator, WinterBoard, Zephyr, ...).
When they hacked the M5 (one week after release!), they used a data-only attack, which is outside the scope of MIE. That could be the case here, or something else entirely. We don't know.
Someone correct me please if I’m wrong but is this because iOS doesn’t sandbox their processes? I think I read Safari in particular doesn’t, but wonder if this is system-wide issue.
The more of this stuff we see, the more people will start using GrapheneOS, I guess.
Also wonder why they choose to publish and not cash-in the Apple bounty..
iOS does sandbox their processes really well, that's why this hack was as difficult as it was. The Safari thing you're talking about is JIT - iOS disables all runtime code generation across the system except in Safari (for JavaScript), but this is a completely separate thing from sandboxing.
Actually, no, I now remember this was about iMessage specifically and how it isn't completely isolated/runs as system service or sth? Or about the renderer?
Which would make sense because these attacks seem to exploit the same weakness.
why do we see pdf viewer exploits on ios when we have sandboxing mechanisms nowadays like wasm? Or is this exploit accounting for the sandbox breakage?
This made me miss Cydia and the old jailbreaking days so much. Was such an exciting time to have an iPhone with the tinkering. Anyone still remember iDitDahText https://iditdahtext.com/iDitDahText.html?
Slightly offtopic but I find it slightly funny that they have accomplished to hack the iPhone yet the name of the third video is: Can you iPhone do this?
I would like to think that they might've created the video so fast and perhaps out of so excitement that the name of the title had the typo :-D
Too bad this will be patched instead of allowing the device owner to control their own device.
Of course it's better that they found that before some shady mercenary spyware company, but I'd also want to control my ios device the same way they did in the video, but no, that's not for us.
I think we will probably see more and more restrictions on frontier models in the coming months. This is not what behemoths like Apple and Sony want to see.
Paradoxically, people are happier to buy things that they have control over, but boy, Apple loves to control every layer of consumerism.
If the current frontier allows for this, we can probably expect alternative models to reach the same spot in a matter of months as well. The cat's out of the bag, for better of worse.
Do we want everyone who doesn’t know how to program a car to reprogram their car? I.e. I think there should be restrictions on frontier models to ensure safety of others.
The paradox is that if the models are restricted, more exposed software will exist. I'm not convinced you can make a model that allows you to build secure software without it also being able to build exploits.
First of all this is crazy that even on hn we were a few days behind this.
Second fuck Apple. Fuck all tech companies. And seriously fuck late stage capitalism. Foss or nothing. There should be a rule if you pay for it it has to be foss. This way people can still make proprietary but they just can’t charge for it.
We have zero privacy, zero security, all our politicians and all the corporations are against us.
Media parsing is an endless exploit vector. Like fuck. At some point you have to be like they (not just Apple) keep it broken
An yea I know foss gets these issues too. But if the only option was foss, then at least the whole world’s focus would be on it
My dream is to release an iOS app that self-installs and not say anything special about it other than having a "Download for iPhone" button on my website. If someone asked me, I'd answer: "Huh, what do you mean? It's our app for the iPhone."
I guess I've never really understood why people who don't like the way the iPhone and apple ecosystem work buy apple products. There are plenty of other options out there. Every time articles about this and the App Store pop up it seems as if the comments are filled with a whole lot of android users that are upset that iPhone's aren't like androids. That's not to say those are all of the comments and there aren't clearly iPhone users who want these options but again, why buy a product that doesn't support these things if they're so important to you in the first place.
Very cool demos, but now I'm interested to know: does enabling Lockdown mode help at all against these exploits? It'll theoretically protect against a lot of common attack vectors, but I'm curious about its real-life effectiveness.
yes for PDFs in iMessage where would be blocked, not sure in Signal though. No idea for 3rd one.
It only blocks auto loading. Clicking on the PDF will have the same effect.
These are still 1-click, not zero click. So the best protection you can have is not opening unknown files that were sent to you. That being said, lockdown mode blocks all sorts of message attachments. From the videos it look like they are using pdfs in the messaging vector, which would get blocked too. So you would be safe-ish. But lockdown mode is so restrictive that it doesn't really make sense for most users. Or at least it doesn't make sense to buy a $1500 phone and then limit yourself to something you could have gotten for $50.
You don’t know what lockdown is do you? I’ve had my phone in lockdown for a year. I can’t: collaborate on notes, and it does not automatically open links in chat. Other than that my experience is identical to non lockdown.
18 replies →
I use Lockdown Mode and the functionality I get is nothing like a $50 device. If you're being serious can you link to some $50 devices for sale that are on par with a recent iPhone Pro running in Lockdown Mode?
#3 is so nice, I want root access to my phone. Does anyone know if doing this can lock Apple out from updating/removing it?
Subverting the secure boot/upgrade chain would require a SecureROM exploit and presumably a compromise of the Secure Enclave, so the answer is almost certainly "no" (even prior major exploits from recent memory like usbliter8 are tethered and don't exploit the enclave; the last true untethered Jailbreak was iOS 9 or something.) An upgrade would fix it. The internet reporting claims this break they are showing in this video is untethered though, which is extremely rare on its own.
The videos sort of imply that these are userland rather than bootrom, whatever payload they have running is getting hit before first unlock, which isn't a lot of surface. They specifically say to not update which pretty much confirms where the attack surface is. Somewhere after the kernel starts but before the main user space is unlocked with the passcode.
I know it's an unpopular opinion, but I disagree.
I want the freedom to install the OS I want on my phone. Now if I install a proprietary OS, I get what the developers of that proprietary OS choose to do. And if that proprietary OS does not give me root access, well, that's life.
the fact this opinion is voted down, is clear proof HN is late to be renamed something else, because hacker it isn't
Well the governments and supranational bodies who want to read your messages would be aghast at you having root on your phone.
Like we did on HTC G1s in 2008
What's with iOS and pdfs pwning them? Reminds me of the ForcedEntry in Pegasus.
https://projectzero.google/2022/03/forcedentry-sandbox-escap...
https://www.trendmicro.com/en_gb/research/21/i/analyzing-peg...
PDF has been an entry point since forever, it is extremely complex and can in some cases even run javascript, it has a huge attack surface.
Why can't Apple just sandbox the damn thing? Run the renderer in a VM, call it a day.
Or just spend a few billion tokens rewriting the whole chain in a memory safe language. This nonsense is inexcusable in 2026
5 replies →
Too huge attack surface. Good candidate for victim trust (who would not open a pdf file on an iPhone?).
So pdf and images are the best vector for iPhones.
Once you escape the parser you have to reach and escape the sandbox and from there reach the kernel.
That's why you need Rust in any image decoder. FFMPEG too.
12 replies →
If it wasn't PDF it'd be something else. It's everything after the PDF that's alarming here - how did they break out of the app sandbox?
I wonder if pdf.js would be more secure since it runs inside a webpage and can benefit from the browser sandboxing. Though I guess iOS has generally managed to keep most of its apps native rather than web app wrappers (as has happened on Windows).
Well it was TIFF one time
TIFFs were used as part of a PSP jailbreak as well iirc
Does Lockdown block all PDFs?
No, it doesn't.
Never mind - that only applied to origins PDF 1.x.
pdf is the new swf
Maybe with LLMs a full rewrite that’s more secure could be done
LLM and full rewrite are a recipe for cooking something that still has flaws but also doesn't work that well. The root cause is that PDF is an old format from a more innocent era. A new document standard that keeps up with the technical and security advances, learns about the lessons PDF taught us, and allows for easy conversion from old PDFs, would be the ideal solution.
Who am I kidding, I think the PDF format will outlive us.
2 replies →
A full rewrite of what? iOS? I hope you’re kidding
3 replies →
Man, sucks to see these "hacked" iPhones doing so many cooler things than my Apple-approved one.
It’s a mix - for years I wanted root on my iPhones, just like you got on android. In practice, once I had it…? I never did much beyond installing Cydia.
With today’s hardware I might have a different take - the 18 has more than enough hardware to be a laptop so maybe I’d use it for a docking mode. But my gut is I’d probably still want a laptop even then.
To me the upshot is : billions of development, software and hardware, have gone into the platforms - it’s hard to quickly make them significantly better.
When I owned an iPod touch, the advantage of jailbreaking was to give your device certain features that the OS just didn't support. (Hell, I remember early days when iOS didn't even have a concept of wallpaper, the background was just black.)
iOS has come a long way since those days so a lot of the most common use cases of the past are no longer necessary. But the principle is the same - the hardware is a general-purpose computer but the software is locked down unnecessarily in many ways. Jailbreaking lets you do things that are outside of Apple's box.
2 replies →
The equalizer is easily 20 years old, and is restricted to presets. Presets! A parametric EQ is the only thing that can make Apple's own Powerbeats Pro sound good. And for several golden years (despite lots of Apple's work against it) we had a really good jailbreak equalizer that worked with Apple Music. Eventually I just gave up on the whole thing. But I remember going out for trail runs with good sounding music without worrying about losing my earbuds.
I jailbroke every iPhone I had for many, many years. Most of the time it was silly skins/tweaks but there were a number of things that were huge QoL improvements. I remember BiteSMS and using it as a way to reply to a text directly in the notification instead of having to leave the app. This was before iOS had that feature and before multitasking, back when if you left the game you were playing the app would quit. Also had folders before stock iOS, things like Control Center, and a whole slew of little tweaks for other apps I used.
The downside to jailbreaking was often the instability but that was also back when the phones were way less powerful. Today, armed with LLMs, I would love to have root on my iPhone again. I'd love to rip out Siri and replace it with Claude Code or something like that.
There's just less reason today for someone like me that liked the utilitarian benefits of a jailbroken iPhone. I used it for gestures, caller mini preview, grouped notifications, etc. All things that are now baked in.
I just want to be able to run things like yt-dlp on iPhone
The only reason to do this today is to turn your iPhone into a tool for other nefarious purposes or clickbot type farms.
I'm for being able to hack your own device to do whatever you like with it, preferably without active resistance from its manufacturer. I'm against anybody who can convince you to open a PDF being able to hack your device to do whatever they like with it.
The point the parent commenter is making is that they want Apple to allow people the freedom to intentionally mod the functionality of their device. Not that they literally want single-click PDF exploits to be a thing.
Who is saying this?
8 replies →
iOS has enough zero-click exploits that you don't exactly get a choice between the two.
1 reply →
[dead]
What in these videos is so much cooler than what you can do on an Apple approved one? Other than, "As a programmer, I can do anything", I just personally don't see any capabilities unlocked that I can't have with an app or whatever. But I might be missing something.
The only thing I really miss from my jailbreak days is an app that could talk to the cellular baseband and display all cell towers nearby on a map and showed which you were using.
I used to have my home screens fully customized but that’s a lot of work creating icons for hundreds of apps. Or even dozens.
1. install apps without the app store so we dont ahve to pay 100 bucks yearly for it to apple
2. run linux
3. run emulators
4. run VMs
5. install steam
6. make it a media server
etc
3 replies →
I watched the “Can your iPhone do this?” video, assuming that was the coolest one. The others seemed like they’d just be showing the exploit.
It seemed like a silly party trick with no practical purpose, and required the terminal to reset things back to normal so the phone was useful again. Why does anyone want this? Surely there are better uses than what was demoed?
I used to jailbreak during the first few years of iPhone. I remember being able to drag out from the bottom right corner of the screen to have a launcher, similar to the Dock, but with more stuff. But over time, the iOS got more features and the argument for jailbreaking became less compelling. This is especially true now that so much sensitive information is in our phones… so I trust all this stuff that effectively has root?
I took this as a demonstration of ownage on the latest release, versus an attempt to show some jailbreak-only feature.
The evidence of hack is the feature.
Noob q: Does this(and most) hacks like this on the iphone likely rely on some kernel module — or what it talks to for executing code — being compromised to run arbitrary code execution? I dunno about ios but it seems from the videos that something that reads imessage attachments was compromised for privilege escalation.
Like what im mean is an attack vector shaped similar to https://pepsipu.com/blog/2026-10-switch2-jailbreak-ns2jb/ i.e. they compromised `fs` module that did not protect against a buffer attack(in memmov)? My understanding is that most core kernel modules are difficult to attack directly because of XOM, PAC and CFI like protections make it impossible for anyone/thing, so most likely only indirect attacks like above can work in such situations — there is a lot of incentive for teams like apple to do everything possible to improve security so i assume only these kind of difficult to find vectors remain.
hacks like these, where you go from a PDF to full persistence, require a chain of exploits. Pegasus, the iOS malware that made the news awhile ago, used a chain of 3 exploits like this:
Hoping more "unsupported" older "iDevices" can be made usable with newer software with something like "jailbreaking"
It's a felony to subvert the natural order of disposable tech consumerism.
I can 100% guarantee that we'll have comments from people saying they buy iPhones specifically because of the walled garden and the last thing they want is a jail broken device. On a website called Hacker News.
50 replies →
Yeah I have a perfectly fine iPad air and pro that are completely unusable. Nothing installs and nothing supports whats installed.
yeah it's kind of weird because some old mac laptops I've used were easy to work with and put on third party software (Linux), but the things like ipads and iphones not so much...
edit: it's like... just give us the same option for the ipads / iphones please?
I just feel a bit sad and impotent that a number of security researchers outside the circle cannot join their "yo we found more crazy bugs" party because simply frontier labs only give access to those models with "Red Team" availability to the inner circle members/companies.
Now their "trusted cyber access" program is moat rather than safeguard.
You can do a lot with the Chinese open source models.
Not in my experience (yes, sample ~= 1), where they are subpar in terms of cybersecurity (e.g. source code review). This is one of my reports using GPT 5.6 (High), GLM 5.3 High, Fable 5.1 [1]:
> On the full benchmark of 31 audited revisions, GPT-5.6 Sol High reached a weighted recall of 38.27% and GLM-5.3 High reached 30.86%. On a common subset of 12 projects, Claude Fable 5.1 High reached 65.70%, against 42.98% for GPT and 35.54% for GLM.
[1] https://github.com/CoinFabrik/soroban-audit-harness/blob/mai...
1 reply →
That assumes you have the hardware capable of running inference on them at a reasonable speed
6 replies →
Anything you can find with an LLM to break into a locked device/ecosystem, the operators of that ecosystem can find with an LLM too, and fix it. Right?
Only if it's in updateable software. Hardware takes longer to correct.
Hence Sam Altman's latest public comment: "I don't even know a dramatic enough word to use… models can find bugs that are outside of the normal threat model of what we think a hacker can do… hardware-level, insane stuff… I no longer think we're gonna be able to just patch all the bugs."
This is true for things other than LLMs. Outside contributors have been credited with hundreds of security fixes to macOS and iOS that were found with fuzzers and sanitizers. Just off the top of my head CVE-2019-8605. Clearly, Apple has access to AddressSanitizer and libfuzzer, but outsiders still find these things. Not only Apple: Google can find flaws in iOS but outsiders also find flaws in Chrome, so the phenomenon is widespread.
Same guys who found the PHP.
Edit: hahaha you guys are funny. “The php hack” is what I meant!
They found the PHP?
Yes, actually PHP was not invented but discovered in nature. That’s why it’s a bit wild sometimes, because it still remembers its origins.
9 replies →
Didn't know that the PHP was lost, thanks for pointing that out.
They found the PHP vulnerability that has upended the world, or so it seems.
The Princely Hippopotamus Parlor in this case.
Is PDF the new Flash? It just does too much for its own good, it has become a huge attack vector
I'm continually amazed that PDF has survived this long while so many other technologies have died. Not only is it a constant vulnerability, but it's not even good at its job. Absolutely miserable UX and DX.
It’s a pity we gave in to the “ecosystem” play by these huge companies.. even if I jailbreak my iOS and never let it update.. Apple can easily detect the jailbreak and lock me out of anything iCloud, and iMessage and such. iPhone would be one glorious iPod touch after that.. :-(
Seeing all these gives me the same energy of early days of jailbroken Android phones where one could become root and do whatever with the hardware… I stopped considering such tinkering because I got tired of finding those little tweaks and fixes on forums like xda every time something was updated. With the LLMs capable of automating that tool, I might find those old school way of mobile phones again…
Vote with your wallet. Fuck them.
You shouldn’t have to use LLMs to run your software.
Give it another 6-12 months until the big AI shops shut those capabilities down and running local ones becomes cost prohibitive.
> Vote with your wallet.
Apple is too big for that. Hard regulation is the only way out right now. Maybe breaking them up too.
132 replies →
I’ll vote with my vote thank you. My table’s manufacturer shouldn’t get a say in what I put on my table, and Apple shouldn’t get a say about my phone either.
These clearly anti-consumer practices should just be illegal.
10 replies →
This comment made me think that someone should pull an ArtCraft on Android or iOS by making a good linux phone skin, with high performance auto-updating wrappers for various web apps to make them as convenient as mobile native ones. Then we can actually ditch the big corps and bask in our LLM-enabled open source utopia. Hmmmmm.
Give it another 6-12 months until the big AI shops shut those capabilities down and running local ones becomes cost prohibitive
I don't expect that to happen, but I do expect Apple et al to spend trillions of tokens hardening their platforms against users and red-teaming to find these sorts of holes before release.
1 reply →
> Vote with your wallet
The loss of your purchase is insignificant compared to the money Apple and Google make from their walled gardens.
Plus what other viable options are there in this duopoly?
Apparently there’s a popular 3rd option in Asia but is there any support for western apps? And how are you going to convince a million other people to switch?
Many Android phones are not unlockable without hacking. They use cryptography to protect the bootloader and to get the unlock code for your own phone first you need to provide them all your information.
Where would you point said wallet? Google isn't far behind Apple on this from, ahead in some ways, and many (all?) of the FOSS Linux powered phones cost even more than iPhones do.
2 replies →
> and running local ones becomes cost prohibitive.
Running local models is getting -cheaper- every month in spite of rising hardware costs due to intelligence compression innovations like Bonsai2.
I build operating systems for a living using only consumer GPUs at home.
> Vote with your wallet
If that would work, I'd be writing this on my iPhone Mini.
2 replies →
>Give it another 6-12 months until the big AI shops shut those capabilities down and running local ones becomes cost prohibitive.
The local inference threshold has been crossed already. Its possible to achieve big model like performance through agent harnesses with local models.
There are already open weight models that are quite capable and can use any provider.
> Vote with your wallet. Fuck them.
Easier said than done. Because, "Apple can do no wrong" is the general public perception. Look at any wrongdoing by Apple - whether they were caught slowing down the phones, degrading cameras on purpose or even the lawsuit where they were caught spying on people's voice recordings. There will always be some NPC defending them as if the billion dollar corporation gives a shit about them.
That or "Apple is the only pro-privacy company in the world" despite there being an active lawsuit against them for the exact opposite.
So, I say: Vote with your wallet. Fuck them...and the fanboys.
1 reply →
Buy Jolla phone
> Vote with your wallet.
But what are the options?
1 reply →
And while you're at it, make real change happen in the US national elections by voting for a third party! That'll show them!
How are running local ones going to become cost prohibitive? Indications are that Nvidia has been channel stuffing (artificially inflating perceived demand), which suggests massive oversupply of GPUs.
> Give it another 6-12 months until the big AI shops shut those capabilities down and running local ones becomes cost prohibitive.
If Murican lobbying/corruption tries to snuff AI that threatens the Hutt cartels, China will accelerate it.
> even if I jailbreak my iOS and never let it update.. Apple can easily detect the jailbreak and lock me out of anything iCloud, and iMessage and such.
As someone who's been jailbreaking since the iPhone 3GS (and held onto a iOS 17.0 device for the longest time), Apple has never bothered to detect jailbreaks and lock people out of iCloud and iMessage.
If anything, it's those sleazy security framework providers that provide jailbreak detection to apps and cause them to either lock people out of accounts and features, or crash entirely.
Some government-mandated audit processes (at least, that's what I understand here in Singapore) also require jailbreak detection.
> Apple has never bothered to detect jailbreaks and lock people out of iCloud and iMessage.
Not entirely true. It absolutely has in the case of the Hackintosh. In fact many a year ago that’s what inspired me to get my first Mac, because every release of macOS made it harder and harder with custom bootloader and kexts to get around Apple’s active efforts to ensure you couldn’t use those unless you were on an actual Apple device, not just running their OS.
4 replies →
> I stopped considering such tinkering because I got tired of finding those little tweaks and fixes on forums like xda every time something was updated.
Several vendors sell Android devices that allow bootloader unlocking, Pixels being the most known.
Once unlocked, Magisk is the current and most used rooting tool.
The procedure is quite straightforward.
https://github.com/topjohnwu/magisk
https://magiskmanager.com/
That's why my next phone will be an unlocked Android device (Shiftphone 8), but murena[0] has also other nice devices that are unlocked.
[0]https://murena.com/products/smartphones/
Or a Pixel with GrapheneOS?
1 reply →
> Apple can easily detect the jailbreak and lock me out
Does this actually happen? They did not do that in the good old days.
I do know that some apps try to detect jailbreaks and annoyingly refuse to let people log in. Banking and such.
Oh man, those early days of XDA forums and SenseUI roms on my NexusOne. Those were truly a thing of beauty. We still haven't gotten back to that level. I'm with you though, I stopped playing and moved to a stock device. Then I moved back to an iPhone and have been completely stock ever since. I haven't been excited about an iPhone since the 10 released. After that I think, "oh cool, another rectangle". "A grid of icons"... "The best camera Apple's ever put in a phone.... how wonderful".
I remember a long while ago when you could jailbreak iOS with a corrupted font in a pdf.
There was a website jailbreakme you simple slid a slider and you were done.
From Wikipedia
August 1, 2010, exploited a vulnerability in the FreeType library used while rendering PDF files.
https://en.wikipedia.org/wiki/JailbreakMe
There have been several companies that tried to sell open mobile devices over the years, but people have shown time and time again that they don't want to buy that product. We can wish it were different all we like, but in general we aren't entitled to money-losing, unmarketable products.
A functioning government committed to free markets would mandate unlocked devices.
The unregulated market naturally coalesces into oligopolies or monopolies and doesn’t fix issues like this.
1 reply →
> Apple can easily detect the jailbreak and lock me out of anything iCloud, and iMessage and such.
Don't sign into any of Apple services then! Just use it as a pure developer playground or create an alternate ID. Can't be looking for everything everywhere :-)
Such antiuser behavior from Apple or others should be illegal.
No you do not. Go buy a Fairphone
Can't anyone customize the source of grapheneOS and simultaneously get a phone that is not trying to disable itself?
> even if I jailbreak my iOS and never let it update.
Two things:
a) Why the would you never want to update an OS in this day and age ?
b) I understand the perspective of people insisting on wanting to be able to root their phone. But how about we take a step back and look at the reality of the 2026 security environment ? An environment where you have:
Frankly. I want Apple to lock down my iPhone as much as possible in that context.
If I want to be root, I can do so on my desktop or a cloud VM or whatever.
But making root on a phone easy just seems like a recipe for disaster... if its easy for you, its easy for the bad guys too.
> a) Why the would you never want to update an OS in this day and age ?
Because updates break the jailbreak. If Apple actually had a sanctioned way to let you do what you want with the device you bought there would indeed be very little reason to not update.
1 reply →
Maybe your phone doesn't have banking and stuff on it
11 replies →
If I'm happy with how it's working, an update can only break things.
Am I the only person/iPhone user that hasn’t given in to the iCloud ecosystem?
I’ve never used iCloud. I hate Apple but I hate Google more. Instead of iCloud I use WebDav, CalDav, Bitwarden and NextCloud. Contacts, calendar, passwords and photos that I control. I recommend the same to others but I can count on one hand who has actually gone away from iCloud into such a setup.
We gave in because open source and hobbiests do not design good products and even worse shared systems, as much as they enjoy self-righteously declaring their values. And shared systems require trust, planning, and goal setting in a way no open system would ever build.
1) They of course lack the resources
2) Often lack professional displince across all skills required
3) Mostly make for themslves or whats interesting, not whats needed.
4) The release schedule is laughable at best.
> open source and hobbiests do not design good products
This is opinion. In my opinion, closed products are not good products. To me, openness and freedom trump subjectively better UX any day.
> as much as they enjoy self-righteously declaring their values.
Consider that in our society and software ecosystem, this is all but required to stave off the forces that would enclose the software commons that these "self-righteous" volunteers work so hard to maintain.
This seems more correlated with big vs. small organizations, not closed vs. open organizations. There are open projects (e.g., Debian, Blender) that tick all four of your boxes in my opinion.
this must be nailed to the wall somewhere at autodesk
linux?
1 reply →
You do understand the reasons right? iCloud, iMessages etc are an interplay of software in your device, software in cloud and some networking. They have to work together. A jailbroken phone can have a tinkered iMessage app. Supporting tinkered / unsupported versions is more overhead / possible security risk. Why would you expect them to take on that?
I agree with your point, though I can easily modify ~/Library/Messages/Attachments or ~/Library/Containers/com.apple.MobileSMS/Data on macOS, which is a platform similarly secure to an iPhone when you take sandboxing, sip, etc. into account. So Apple already supports macOS, which can be tinkered, no? I guess the argument is that by locking down iOS, a platform which was never open, they just never needed to handle that class of security risks which are introduced when customers have more freedom.
I did actually discover a bug in iOS (related to photos which have failed to sync to icloud for the past four years) by investigating why there were over 23k empty folders in ~/Library/Containers/com.apple.photos.ImageConversionService/Data/tmp/, fwiw.
1 reply →
My computer is jailbroken, I have sip disabled yet icloud and imessage work. So what makes my computer different from my phone?
1 reply →
Who bears the security risk? The user.
The only security risk for apple is a job security risk if the ecosystem lock-in is eroded.
2 replies →
A reminder for people who don't follow this, Calif is Thai Duong's firm. Thai discovered the BEAST and CRIME TLS attacks (with Juliano Rizzo), and then worked at Google for a bunch of years, including on Wycheproof with Daniel Bleichenbacher. The team at Calif includes lcamtuf, Dion Blazakis, Tavis Ormandy, and Stefan Esser (among many others).
They're basically the most interesting team working in vulnerability research right now; a cross product of ludicrous talent and full-tilt AI work.
Just before I left Fly.io a few months ago, we retained Calif for an annual pentest (we'd previously worked with Tetrel, Atredis, Doyen, and I think Include?). They were spooky good. Everybody we'd worked with was good, but Calif's results were unusually high-impact.
I love these people and everything they're doing.
Thanks Tom! You're always super kind to us.
Video 3 get a root shell agains 27.0.1 which is the latest iOS version installed on my lovely se3.
This really blown my mind, and seem the 1/2 video is installed a app by click pdf link?
I guess and hope there will be update from apple quickly
There are loads of these exploits which exist in the hands of private hacking groups and state organisations which have not been made public. Always assume your device is able to be compromised from those who have the motivation and dedication.
Is it an exploit around the library that handles PDF parsing/opening? Can someone explain how files / attachement are open on a mobile device ( android/iPhone).
I don't understand how in 2026 this is still a thing, we have many safe languages to parse/deserialize data. Why is it complicated?
PDFs are basically executables, that's why it's hard. They support running code, they support decoding images which themselves have their own custom compressors that are basically code. Anything to do with image formats is rife for bad decoders, insane compression algorithms from the 90s, and a PDF is basically 1000 formats inside many different container types with executable code plastered on everywhere. If you want to make a compatible PDF viewer you'll need to be able to implement an image decoder algorithm for a fax machine that was specific to Japan in the late 80s, which was somehow ratified into a standard and is used today by all the top legal firms, or something absurd like that. When you open a PDF on your computer, depending on how it is being parsed, it can even make outbound network connections without you knowing. To safely open a PDF you need one of those bomb proof suits, a disposable laptop, and even then you might be going home without eyebrows.
Willing to bet that a default "treat PDFs/documents/spreadsheets as dumb" option in operating systems would eliminate the majority of common one-click vulnerabilies out there. And exactly 0.001% of actual use cases would be affected.
14 replies →
> PDFs are executables, that's why it's hard.
That isn’t really true, it’s not hard for PDF viewers to block by default (or just not implement) the problematic features, which also aren’t critical for the vast majority of PDF files.
The exploitable bugs are typically the usual, some buffer overflow in an underlying image or font library or similar, but unrelated to PDFs being “executable”.
4 replies →
> PDFs are executables, that's why it's hard. They support running code
I don't think Apple's PDF renderer supports e.g. running JS, you'd need real Acrobat for that. Or are you talking about something else?
> they support decoding images which themselves have their own custom compressors that are also basically code themselves.
But this is fundamentally true for anything that displays images, right? Or are the PDF formats particularly bad for some reason?
2 replies →
From the standpoint of a layman it looks like there's a lot of overlap between writing safe web browsers/engines and writing safe PDF readers/engines. There just hasn't been anywhere near as much of an impetus to push PDF readers/engines in that direction because most of us aren't interacting with PDFs nearly as often as we interact with the web (and things built on web tech).
2 replies →
I'm pretty sure not even the safe languages would help you here. PDF allows you to pretty much run arbitrary code since it supports javascript, images, and a bunch of other things I'm forgetting, and you can't not implement javascript support or otherwise be selective about what you support with it because then all the end-users will complain when they get that one PDF that they need to fill out but it needs JS because... Nobody knows.
Cool to see our work here. I'm Thai, and I run Calif. Happy to answer any questions.
We'll publish the technical details of these hacks over the coming weeks. Writing these articles takes time, and we've been busy with a PHP thing [1].
In the meantime, check out The Great Glyph Grift [2] for a glimpse of what can go wrong when iOS parses PDFs.
Just in case you wonder, we've disclosed most of the bugs in these exploit chains to Apple and will disclose the rest. So far in 2026, we've reported close to 100 bugs to Apple. We don't accept Apple bounties, and we're not being paid for this work. We don't sell bugs or exploits, and we have no sponsors funding this research.
We do this because it's fun, intellectually challenging, and we want to help make the iPhone safer. We also have a business to run, so we do need some marketing points.
[1] https://calif.io/php2shell
[2] https://calif.io/research/the-great-glyph-grift
Why not accept the Apple bounties and donate it or something?
Hey Thai- How much of the at Calif is managing agents to explore ideas? Are ideas coming from agents themselves or still human generated, and has that changed since y'all started the company?
On the cost side- How expensive is it to develop each of these demos w.r.t. inference cost? Are y'all purely using OAI/A\ cyber models or are there OSS models being used too?
Big fan!
Oh boy, what a week. Must be great working in cybersec right now.
It is rapidly becoming cyber only (assuming it is not already there under the hood).
would this let you use the usb port to host serial devices? Swooning pretty hard at the idea of this. <3
#4 is very interesting. Truly untethered (persistent) jailbreaks haven't been a thing for 10 years.
This brings back lots of memory of jail-breaking iPhone era and cydia the alternative jailbroken iPhone app store.
The second video, the person who's shooting the video has his face mirrored onto the screen, anonymity is gone.
More details: https://onejailbreak.com/blog/iphone-duo-ios-27-1-jailbreak-...
i suspect there is an article under all of the ads but i don't have the patience to look for it
I suspect you don't use an ad blocker :-)
I'm not sure if this is real, but if it is: this week is unbelievable. I really hope it's not the new normal, but unfortunately I don't believe this myself.
It's a minuscule part of the new normal.
If this continues I'll argue that you have to be absolutely insane to allow network connected electronics into your home in the future. This is Apple, known for locking down their device to the extreme, and yes some people would love to use this for jailbreaking their phones, other organisations want to root your phone for .... other purposes.
Insecure webpages, broken certificates and an insecure PDF library... You shouldn't have anything more connected than an FM radio at this point. Security is no longer something a private individual can deal with.
> You shouldn't have anything more connected than an FM radio at this point.
They can still hack your mind with ads.
There's every incentive for nation states and other espionage outfits to keep these types of exploits under wraps. This has probably been the new normal for some time ..
I for one have experienced multiple lifetimes worth of internet madness and will be looking to airgap / disconnect as many devices as I can get away with.
People have been paying a premium to companies like Apple for a reason. You've got nothing to worry about.
Decade of people's purchases has been invested into safety and security. It's absolutely unthinkable that a $7t market cap company with an army of 200k workers will ever leave people high and dry. They proudly went public, so we know they have the public's interests at heart.
I assuming there is a /s missing from the end of your post.
> They proudly went public, so we know they have the public's interests at heart.
God I hope this is sarcasm.
I think in time (a few years) the gap will close a bit. As AI is used to harden software, it will be harder to break. Software not validated by AI will continue to be vulnerable to it.
So what happens if AI becomes something that you need to actually pay real money for? Then only Apple, Google and Microsoft can affort to do network exposed software. Smaller companies and solo developers are just f-ed if the price of running LLMs goes up as investor money dries up.
It would make me so happy if this would allow running UTM.app with Hypervisor support on iPadOS. I don't want to travel with two devices, the would be enough, but sometimes I need a real desktop. Apple, of course, wants you to buy two devices. I do have UTM with Jit Linux running on my iPad, via altstore and entitlements and so on, but it is all a bit complex and still fairly slow.
the videos just don't hit the same without the dancing anime girl and the electronic dance music.
My favourite part from the first video is how much effort it took to drag up from the bottom of the screen to get back to the home-screen. This reflects my experience with how iOS handles touch gestures in general.. also super easy to accidentally activate "Reachability" mode!
The reason they're having trouble is because they're in the simulator.
Also, if reachability bothers you like it does me, you can disable it.
Seriously I want a physical home button again
10 replies →
https://x.com/calif_io/status/2113570095549337977
We peaked in the early 00s with warez key generators featuring banger synth tracks.
You might enjoy Dubmood - Lost Floppies Vol 3, released this year.
Don't worry, they got you:
https://xxcancel.com/calif_io/status/2113570095549337977
Here you go… https://lnkd.in/p/g9_uh79c
So true.
Just let me know when I can install an alternate OS to my junk drawer of 6-10 year old iPhones. That's the holy grail.
They are going to run out of vulns eventually when the code is rewritten in memory safe lang & the rest are found.
> They are going to run out of vulns eventually when the code is rewritten in a memory safe lang
that's just not how it works at all though is it. Good luck writing the kernel, firmware etc in a completely memory-safe way. And even if that was accomplished, memory safety isn't the only class of vulnerabilities, it's just the most common.
> and the rest are found
If they kept a stable version with no updates or new features *ever*, only security patches, for decades, then maybe that could be possible, yeah. But Apple users aren't exactly the kind of people who would enjoy such stability and security anyways, it comes with the compromise of novelty. Stability and security aren't very fashionable either.
edit: Obviously a "memory-safe way" means no `unsafe` blocks in Rust, too.
edit#2: This is all assuming we don't get true AGI. I hope my assumption is right
He's right though. We'll run out of vulnerabilities eventually.
1 reply →
Crazy, you would think Apple would have already done AI-assisted vulnerability scans using the latest and most expensive models.
Absolutely crazy how PDF parsing and image rendering are still exploitable.
Aside from bragging how cool they are, what value is there for demonstrating a yet-to-be-patched vulnerability? I don't understand why old-guard infosec stars from Calif can do as they want, responsible disclosure be damned.
Just as a reminder for some folks here: During their WeWorm research in July–September 2026, Calif didn't stop at proving RCE to Tencent—they spent an extra week using AI to build a fully functional, self-propagating zero-click worm across three live phones, triggering temporary account bans from Tencent during testing.
I don't see this as irresponsible disclosure. They show that the vulns exist, but don't give any other details (unlike previous Calif releases). Not even a hint at what the exploit chain is like other than that it starts with a PDF, which is a surprise to no one.
They're of course also doing it for internet kudos, but attracting attention like this will help encourage people to update. Thanks to this article, I'm going to apply the next iOS security update ASAP, and tell everyone I know to do this the same. (hopefully it comes out soon)
I do wish they clearly stated the vulns have had been reported to Apple and when.
We disclosed most of the bugs used in these chains to Apple, and are going to disclose the rest, if not already.
>Just as a reminder for some folks here: During their WeWorm research in July–September 2026, Calif didn't stop at proving RCE to Tencent—they spent an extra week using AI to build a fully functional, self-propagating zero-click worm across three live phones, triggering temporary account bans from Tencent during testing.
Not sure what exactly your point is. The WeWorm demo was done in a controlled environment.
Also we do this for free. We don't charge neither Tencent nor Apple. We don't even take their bounties. Why can't we have some fun?
If you're so upset about how we do it, my suggestion is go find your own bugs.
You literally just said your company released an exploit demo before disclosing some of these vulnerabilities to the vendor.
As for your suggestion, I was an infosec researcher, I worked for 3 years with vendors to help them patch before I can even tweet anything about my research. I even flew to their HQ to assist in patching when needed. After Covid I transitioned to a development role, and now I'm on the other end, handling security reports from researchers.
Based on this dual point of view, let me tell you that for a security engineer in Apple that will learn from your video about vuln your company did not even disclose yet, this karma harvesting is as far from "coordinated disclosure" as possible. Their managers will be fuming, and the stress they will be in given the media frenzy will be off the charts.
Very cool work, I love what you guys are doing!
Is it irresponsible? They've revealed barely anything about how it works, besides that the first step is a PDF, and something about Glyph Grift.
What is the value of revealing anything at this time point, when no patch is out? What use is it for the public?
Just last Black hat there was a "glimpse disclosure" that was later followed with proper fixes and details. I gave my AI agent the details that were supposed to be "useless", before the patch was out, and it found the vulnerability in less than an hour.
We shouldn't even enter this game. And with the track record of this specific group, I didn't exactly get the impression that their incentive is to help fix things, but rather to promote their brand while others be damned.
I want to boot linux in a vm at full-speed. is that too much to ask?
Please let this be real. I need my 17 Pro to be jailbroken. I may keep my 13 Mini if it works for it too. This will be bliss.
What are these videos actually demonstrating?
A couple of PDF exploits from iMessage and Signal leading to code execution, and an app that roots the phone. Also, they seem to have managed to make their malware survive a reboot, which is difficult. That's another reason why automatic reboots are considered a security feature: exploits leaving malware in-memory are a lot easier to build than malware that survives a full reboot, passing all stages of signature checks and validation.
Yes, why don't they just say it instead of posting videos. Opening a sinister PDF in iOS can give them access to what exactly? anything/everything? What iOS versions or devices, etc?
Check out https://calif.io/research/the-great-glyph-grift, which shows one could go wrong with PDF in iOS.
We're gonna publish more in the coming weeks. Writing these blog posts take time, and we've been busy with another PHP thing.
1 reply →
Marketing by security researchers and companies has gotten unbearable. They only want their name out there and not actually make devices more secure.
2 replies →
Rooting, pretty much. Aka, executing code which shows their flying logo, but could also be exfiltrating data without displaying anything.
This post gave me flashbacks to jailbreak era w/ Cydia. It's interesting to think that a lot of the those old plugins and tweaks have basically become standard supported features of the iOS now (SBSettings, Activator, WinterBoard, Zephyr, ...).
Stay on 27.0 or upgrade to 27.0.1?
How did they bypass MTE? Wasn't it suppose to make such exploits basically impossible?
We don't know if Calif bypassed MIE.
When they hacked the M5 (one week after release!), they used a data-only attack, which is outside the scope of MIE. That could be the case here, or something else entirely. We don't know.
https://news.ycombinator.com/item?id=48139219
Someone correct me please if I’m wrong but is this because iOS doesn’t sandbox their processes? I think I read Safari in particular doesn’t, but wonder if this is system-wide issue.
The more of this stuff we see, the more people will start using GrapheneOS, I guess.
Also wonder why they choose to publish and not cash-in the Apple bounty..
iOS does sandbox their processes really well, that's why this hack was as difficult as it was. The Safari thing you're talking about is JIT - iOS disables all runtime code generation across the system except in Safari (for JavaScript), but this is a completely separate thing from sandboxing.
Actually, no, I now remember this was about iMessage specifically and how it isn't completely isolated/runs as system service or sth? Or about the renderer?
Which would make sense because these attacks seem to exploit the same weakness.
2 replies →
Is this day0 or did apple and signal get notified?
so i see we're still going with the apocalypse today too
why do we see pdf viewer exploits on ios when we have sandboxing mechanisms nowadays like wasm? Or is this exploit accounting for the sandbox breakage?
I'm tired, boss
Right that does it. I'm fucking off to the pub and drinking myself under the table after this week.
Ok so you became "root", but who knows, Apple might have "superroot" and if that is not enough "god-mode".
Apple does have that and generally you need to break it to do the kinds of things demonstrated here
No anime girl videos. Progress!
Here you go! https://x.com/calif_io/status/2113570095549337977
guess who put themselves on the must-hack list of every single national intelligence agency
Man... PDF is such an unfortunate file format.
Oct 16th post;
More recently: iPhone Duo Jailbreak vid https://x.com/calif_io/status/2113570095549337977 (https://news.ycombinator.com/item?id=50206680)
Apple doesn't use AI to vibecode and/or pentest their software?
I think we have a right to know.
Well, surely you know that “AI” is just pattern matching and useless for Real Engineering work by Real Engineers.
Yeah, real engineers don't use grep either ...
This made me miss Cydia and the old jailbreaking days so much. Was such an exciting time to have an iPhone with the tinkering. Anyone still remember iDitDahText https://iditdahtext.com/iDitDahText.html?
Slightly offtopic but I find it slightly funny that they have accomplished to hack the iPhone yet the name of the third video is: Can you iPhone do this?
I would like to think that they might've created the video so fast and perhaps out of so excitement that the name of the title had the typo :-D
Too bad this will be patched instead of allowing the device owner to control their own device.
Of course it's better that they found that before some shady mercenary spyware company, but I'd also want to control my ios device the same way they did in the video, but no, that's not for us.
In principle it should be possible to jailbreak-patch the OS so that it will patch any patches to your liking.
So you think they will release the full exploit?
public wont be getting this jailbreak, it is just another flex like elon's flipping car.
In this thread. Apple Acolytes Anonymous.
Seriously, California has a cathedral problem, may the vault dweller succeed.
Now - does the Signal 1-click work on Graphene?
I think we will probably see more and more restrictions on frontier models in the coming months. This is not what behemoths like Apple and Sony want to see.
Paradoxically, people are happier to buy things that they have control over, but boy, Apple loves to control every layer of consumerism.
Apple doesn't want security researchers to find bugs? Then why do they have a $2m bug bounty?
Awarding security researcher != Average Joe being able to jailbreak your device.
Hope you understand the difference.
If the current frontier allows for this, we can probably expect alternative models to reach the same spot in a matter of months as well. The cat's out of the bag, for better of worse.
Do we want everyone who doesn’t know how to program a car to reprogram their car? I.e. I think there should be restrictions on frontier models to ensure safety of others.
The paradox is that if the models are restricted, more exposed software will exist. I'm not convinced you can make a model that allows you to build secure software without it also being able to build exploits.
First of all this is crazy that even on hn we were a few days behind this.
Second fuck Apple. Fuck all tech companies. And seriously fuck late stage capitalism. Foss or nothing. There should be a rule if you pay for it it has to be foss. This way people can still make proprietary but they just can’t charge for it.
We have zero privacy, zero security, all our politicians and all the corporations are against us.
Media parsing is an endless exploit vector. Like fuck. At some point you have to be like they (not just Apple) keep it broken
An yea I know foss gets these issues too. But if the only option was foss, then at least the whole world’s focus would be on it
Bro rewrite IOS in Rust :)
My dream is to release an iOS app that self-installs and not say anything special about it other than having a "Download for iPhone" button on my website. If someone asked me, I'd answer: "Huh, what do you mean? It's our app for the iPhone."
You can do this on Android
Not for long now...
2 replies →
BASED
Eli5 the iMessage video? They open a file that calls their webapp?
Curious to see how many tokens was spent
I guess I've never really understood why people who don't like the way the iPhone and apple ecosystem work buy apple products. There are plenty of other options out there. Every time articles about this and the App Store pop up it seems as if the comments are filled with a whole lot of android users that are upset that iPhone's aren't like androids. That's not to say those are all of the comments and there aren't clearly iPhone users who want these options but again, why buy a product that doesn't support these things if they're so important to you in the first place.