Offensive security researchers walked an iPhone 18 Pro onto a conference stage, jailbroke it in front of a live audience, then rebooted it to prove the hack survives a full restart.
The demonstration took place at Hexacon, the offensive security conference run by French firm Synacktiv. A researcher known as Calif showed the device coming back up with root access intact after showing the Apple logo and accepting the owner’s passcode. No computer was needed to re-arm the exploit – the defining trait of an untethered jailbreak, as opposed to tethered variants that die with the battery.
The session ran on iOS 27.0.1, build 24A446, on hardware the jailbreak community had written off as hardened beyond reach. The root shell revealed a T8160 chip running Darwin kernel 27.0.0, with the handset reporting itself as an iPhone19,2. A remote connection over SSH on port 2222 landed as root, and an identity query came back uid=0.
Researchers described the obstacles modern iPhones put in an attacker’s path: breaking out of the application sandbox, gaining kernel privilege, and beating hardware-backed defenses such as Pointer Authentication Codes. Keeping the state alive after a restart compounds the difficulty, since startup-time software is meant to be verified by the boot chain.
Details remain thin where they matter most. The team withheld the bugs it chained and shipped no tool the public could use, and the lock screen was opened with a valid passcode rather than defeated. Root privilege on its own also leaves the entry vector unexplained, so nothing here suggests an attack that arrives remotely.
Apple’s September 14 release closed a broad batch of memory-safety, sandbox and privacy issues. Which of those, if any, relate to the stage demo is unstated, so nobody can yet say whether the flaws are patched.
