At the recent Hexacon offensive security conference in Paris, Calif.io demonstrated a public ‘perfect jailbreak’ for the iPhone 18 Pro running iOS 27.0.1. Notably, this achievement maintains the highest level of system access even after the device is rebooted.
What is a ‘Perfect Jailbreak’?
A jailbreak is the process of removing restrictions imposed by Apple on the iOS operating system. It grants users the highest level of access rights (root) to the system. This, in turn, enables the installation of apps not available on the App Store, full access to the file system, deep interface customization, and the removal of pre-installed applications.
Traditional jailbreak methods often require re-connecting to a computer or re-exploiting certain vulnerabilities after each device reboot. In contrast, an ‘untethered jailbreak’ means that the compromised state of the system persists even after the iPhone is turned off and on.
Demonstration and Technical Aspects
During their presentation at Hexacon, researchers from Calif.io successfully showcased this process. After rebooting the iPhone and unlocking it with a standard passcode, they were able to instantly open an SSH session with root user privileges. Information displayed in the terminal confirmed that the device was running iOS 27.0.1.
Modern iPhones feature extremely sophisticated security systems. A successful jailbreak typically requires chaining multiple vulnerabilities. This includes escaping application sandboxes, gaining control of the operating system kernel, and bypassing hardware protections like Pointer Authentication Codes (PAC). Maintaining access after a reboot necessitates overcoming Apple’s boot code verification mechanisms, making Calif.io’s demonstration particularly significant.
Next Steps and Limitations
Despite the successful demonstration, ordinary users cannot currently perform this jailbreak themselves. Calif.io has not yet disclosed the specific vulnerabilities exploited, technical details, or download tools. They have only stated that relevant information will be published ‘in due course’.
Beyond the untethered jailbreak demonstration, Calif.io also presented other developments at the conference, including a one-click attack on Signal and demonstrations related to iMessage.
