A chain that outlives a restart looked for a moment like the end of Memory Integrity Enforcement, the hardware defense Apple leaned on when it introduced the A19 chip. Two weeks of patching have narrowed that claim considerably.
The demonstration itself is old news by now. Researchers at Calif showed at October’s Hexacon conference in Paris that they could run enough of an exploit chain to gain root on an iPhone 18 Pro and keep it there after a restart, then repeated the trick on an iPhone Duo on its launch day. Stefan Esser, who led the work, has since confirmed to iTnews that iOS 27.2 closed most of the flaws the chain depended on, and Apple credited his team across multiple advisory entries.
The memory-integrity piece lands in CVE-2026-113950, credited to Esser and Substrate, described as a memory integrity issue fixed through better handling of copy-on-write pages. Elsewhere in the same release, a cluster of kernel bugs shared a pattern: apps that could corrupt, write, or read kernel memory with no further privilege. Memory integrity shows up as a recurring theme rather than one bug.
The fixes arrive with help from AI
Worth noting alongside the patch list is who found what. Anthropic Research appears on three entries and OpenAI on four, including work credited to OpenAI’s Codex Security team. Apple always argued that memory safety and AI-assisted bug hunting would scale against each other; this release is an early data point on which side moves faster.
No real-world abuse of any bug in the iOS 27.2 list had surfaced, and Calif published no technical detail of its chain. The lesson is unchanged: the jailbreak prompted the patch rather than following it, and hardware running below iOS 27.2 still carries the attack surface those researchers mapped.
