A trade secret lawsuit between a digital forensics firm and a security research group has escalated into a broader fight over who controls unpublished vulnerabilities, after a federal judge ordered the removal of technical details about an unpatchable flaw in millions of iPhones.
The issue at the center of the case is a SecureROM exploit called usbliter8 that affects Apple’s A12 and A13 processors embedded in the iPhone XS, XR, 11 series, and second-generation SE. The flawed code lives in read-only memory etched into the silicon during chip fabrication, which means Apple cannot issue a software patch to remove it.
The dispute began after Paradigm Shift published its findings on June 18, 2026, crediting the research to an engineer who had previously worked at Magnet Forensics under a contractor agreement. Magnet argued in a July 7 complaint that the exploit was not independent research but instead a stolen trade secret the firm had developed internally under the codename “MSG.”
U.S. District Judge Victoria Marie Calvert agreed the company had shown enough evidence of likely success on its trade secret claim to warrant a preliminary injunction. She ordered Paradigm Shift and former Magnet engineer Mario Del Gaudio to delete the blog post, exploit code, and all related materials by July 23. The company complied and replaced the original post with a takedown notice.
The case raises difficult questions about the ethics of commercial zero-day stockpiling. Forensic firms like Magnet sell law enforcement access to unpublished vulnerabilities and have little incentive to disclose them to manufacturers. Security researchers argue that publication forces fixes and protects users.
The underlying exploit requires physical USB access to a device in DFU mode and programmable hardware to deliver malicious USB packets, making it impractical for mass attacks but highly valuable for targeted forensic extractions. The court noted the order cannot undo copies already downloaded, and Apple retains whatever technical knowledge it gained from the disclosure.
