A confidential sales document says forensic labs can now pull a locked iPhone’s contents out of a room through the air, from about eight metres away, with no cable and no cooperation from the owner.
The flyer, shared by security blogger justin.sh, describes a Cellebrite product called Advanced Unlocks. It claims after-first-unlock access to iPhone 11 through iPhone 16 handsets running iOS 26 through 26.4 or later, and works with Stolen Device Protection switched on, the feature Apple added to slow down exactly this kind of attack.
Why a radio vulnerability fits
Cellebrite calls it a next-generation vector more resilient to Apple’s operating system changes. A cable cannot reach eight metres, so the blogger argues Bluetooth is the only plausible carrier, sitting below every layer Apple can easily rebuild. Comparing bluetoothd between iOS 26.4 and 26.5, he found fresh L2CAP hardening, including a use-after-free in the channel manager’s receive loop. L2CAP signalling packets arrive before pairing, so any device in range can send them.
That flaw is a candidate, not a proven exploit chain. No proof of concept exists, and Cellebrite has neither confirmed nor denied the document.
Two patches Apple shipped quietly
The September 14 rollout of iOS 26.7 and iOS 27 closed CVE-2026-65414, an out-of-bounds write in Bluetooth that could let a remote attacker run arbitrary code, and CVE-2026-86919, a stack overflow reached from a paired device. Neither was flagged as exploited. The supported roster ends one generation early: iPhone 17 and Air, which ship Apple’s Memory Integrity Enforcement hardware tagging, appear nowhere in it.
What owners can do
Update to iOS 26.7 or iOS 27 to close both bugs. Switching the radio off means opening Settings, since Control Center just drops connections. A restart wipes that unlocked state.
