Researchers have jailbroken an iPhone with iPhone Lockdown Mode switched on, and the hack survived a reboot. It doesn’t mean your phone is open to everyone, but it does dent Apple’s “extreme protection” claim. Here’s what happened and what you should do.
Quick facts to start with:
- The team behind it is security firm Calif, which showed an untethered jailbreak on an iPhone 18 Pro.
- Reported attack path: a malicious PDF sent over AirDrop that the target had to accept.
- Calif says it is disclosing the bugs to Apple and won’t release a public jailbreak tool.
- Apple shipped iOS 27.2 on October 26, which fixed most of the flaws Calif used.
Those four points are the whole story in short. The details below explain why sources disagree on whether the hole is closed.
What Calif actually showed
Calif, led by researcher Stefan Esser, first showed its exploit chain at the Hexacon conference in Paris, according to iTnews. It produced an untethered jailbreak on an iPhone 18 Pro running iOS 27.0.1. “Untethered” means it stays in place after a restart.
A week later the same team jailbroke the new iPhone Duo on launch day, October 23, running iOS 27.1. The chain also got past Memory Integrity Enforcement, Apple’s hardware memory protection built into recent chips.
Then MacRumors reported on November 3 that Calif had repeated the trick with Lockdown Mode enabled. A video shows a malicious PDF arriving through AirDrop, which the user has to accept.
Is the Lockdown Mode hole closed?
That’s still unclear. MacRumors says the jailbreak persisted after the phone updated to iOS 27.2, and it doesn’t say whether it works on a phone that started on 27.2.
iTnews, meanwhile, says iOS 27.2 fixed most of the bugs in the chain. Apple’s release patched 163 vulnerabilities, and Apple said none was known to be exploited. We don’t have a fresh Apple statement on the Lockdown Mode demo, so treat “fully fixed” and “still open” as both unconfirmed.
It’s also worth remembering the context. Earlier this year Apple told reporters it knew of no successful mercenary spyware attacks against Lockdown Mode users. A research demo is not an in-the-wild attack, but it shows the wall can be climbed.
What iPhone Lockdown Mode still blocks
Lockdown Mode shrinks the attack surface by turning off features that spyware often abuses. The table shows the main trade-offs.
| Area | What changes with Lockdown Mode on |
|---|---|
| Messages | Most attachment types are blocked, and link previews are off |
| Web browsing | Some complex web technologies are disabled, so a few sites may load slower or look off |
| FaceTime and invites | Incoming calls and invitations from people you haven’t contacted are blocked |
| Cable connections | Wired connections to computers and accessories are blocked while the phone is locked |
| Profiles | New configuration profiles can’t be installed |
These limits are why most people don’t use it. They’re also why a bypass that needs you to tap “accept” on a file is a social-engineering problem as much as a technical one.
Why a jailbreak matters beyond hobbyists
A jailbreak gives root access, which means full control of the system. For hobbyists that opens the door to sideloaded apps and tweaks. For spyware makers, the same access means reading messages, tracking location, and switching on the microphone.
That’s why researchers treat “survives a reboot” as a big deal. Most iPhone spyware has to be re-delivered after a restart, which gives defenders a chance to notice. A persistent chain removes that safety net.
It’s also why Apple pays attention to demos like this. Fixes usually land within weeks once details reach the company. Our look at APT29’s mobile exploits shows how fast patched bugs get used against people who delay updating.
What to do today
Nothing here needs special skills, and most of it takes under two minutes. Work through these in order:
- Update to the newest iOS version in Settings > General > Software Update. If you’re on an older release, our iOS 27.2 breakdown shows what changed.
- Set AirDrop to “Contacts Only,” or turn receiving off, so strangers can’t push files at you.
- Never accept a file you didn’t expect, even if the sender name looks familiar.
- If you’re a journalist, activist, or executive, keep Lockdown Mode on in Settings > Privacy & Security.
Updates matter most because they shut the doors researchers and attackers find. If you got an Apple warning recently, read what to do if you got a threat notification.
Frequently Asked Questions
Should I turn off Lockdown Mode now?
No. Keeping it on still blocks many common attack routes, and the demo needed you to accept a file. Leaving it off removes protection for no gain.
Is my iPhone at risk of being jailbroken by this?
Very unlikely. Calif says it won’t release a public tool, and it is reporting the bugs to Apple. Real-world attacks like this usually go after targeted people, not everyone.
Does iOS 27.2 fix the problem?
Apple says 27.2 fixed 163 vulnerabilities, and iTnews reports it closed most of the flaws in Calif’s chain. MacRumors says the Lockdown Mode jailbreak survived the update, so it isn’t settled.
How do I turn on Lockdown Mode?
Open Settings > Privacy & Security > Lockdown Mode, tap Turn On Lockdown Mode, and restart when asked. You can exclude a trusted website or app later if something breaks.
The bottom line
Keep Lockdown Mode on if you’re a likely target, and keep iOS updated no matter who you are. This demo shows no security setting is perfect, but it’s a lab result, not a wave of attacks. Be careful with unexpected files, and check back once Apple answers Calif’s report.
Leave a Reply