On October 16, on a stage at the Hexacon security conference in Paris, a researcher from Calif.io did something iPhone owners have not seen in about a decade. He rebooted an iPhone 18 Pro running iOS 27.0.1, typed in the passcode, and roughly two minutes after boot he had a root SSH session open on the phone, uid=0, the highest level of control the system offers. No laptop. No cable. Nothing plugged in, nothing to re-run. The word for that is untethered, and it is why the room paid attention.
Most people hear “jailbreak” and think of it as one thing. It is not. There are four distinct kinds, and the difference between them is exactly what Calif.io showed off: what survives a reboot.
Four kinds of jailbreak, separated by one question: what happens when you reboot?
Tethered. The original sin of jailbreaking. In the redsn0w era of the early 2010s, the exploit patched the running kernel in memory, and memory is wiped at every shutdown, so the patched kernel had to be loaded by a computer at every single boot. Press the power button away from your desk and many devices would hang at the Apple logo, unusable, until you got home and clicked “just boot” in the desktop tool. Your phone was chained to your computer, hence the name.
Semi-tethered. The phone boots on its own, but into ordinary stock iOS. The jailbreak sits dormant until you connect the phone to a computer and run the tool again. The definitive example is checkra1n, released in November 2019 on top of checkm8, a flaw in the read-only Boot ROM of Apple chips from the A5 to the A11. Because that code is burned into silicon and cannot be patched by an update, those devices stay jailbreakable forever, but only in this half-on, half-off way.
Semi-untethered. The phone boots stock, and then you fix it from the phone itself: open an app, tap a button, wait for the exploit to run again. No computer involved. This is how unc0ver and Taurine, the everyday tools of the iOS 11 to 14 years, worked. It is convenient, but the jailbreak still dies at every reboot, and the app itself leans on signing workarounds or developer certificates that can expire or be revoked at the worst moment.
Untethered. You reboot, and nothing changes. The jailbreak is simply still there, because the exploit re-applies itself during startup, before you ever see the lock screen. JailbreakMe did it from a web page in 2011. Evasi0n did it for iOS 6 and 7. Pangu did it for iOS 9 in October 2015. It is the most convenient form by a wide margin, and it has been effectively extinct ever since.
| Type | After a reboot | To restore the jailbreak | Classic example |
|---|---|---|---|
| Tethered | May not boot at all | Computer, every boot | redsn0w (iOS 4 and 5 era) |
| Semi-tethered | Boots into stock iOS | Computer | checkra1n (2019) |
| Semi-untethered | Boots into stock iOS | An app on the phone | unc0ver, Taurine |
| Untethered | Still jailbroken | Nothing | Pangu for iOS 9 (2015) |
Apple’s boot chain verifies every stage, and that is the whole problem
Every iPhone startup is a relay race of cryptographic signatures. The Boot ROM, code fused into the chip at the factory, checks the signature of the next stage, LLB. LLB checks iBoot. iBoot checks the kernel. If any signature fails, the chain stops. After boot, code signing rules decide what is allowed to run at all, the sandbox keeps apps fenced into their own corners, and since the A12 chip in 2018, Pointer Authentication Codes (PAC) cryptographically sign pointers in memory, so even an attacker who lands a kernel exploit has a much harder time bending the system’s control flow.
An ordinary jailbreak cheats that system once, from inside a phone that is already running. An untethered jailbreak has to cheat it during the few seconds when the chain is being re-verified, on every boot, reliably, without turning the phone into a paperweight. That takes a very specific combination of early-boot bugs firing in exactly the right order, and Apple has spent a decade making sure the combination does not exist. The scoreboard tells the story: the last public untethered jailbreaks were Pangu’s tools for iOS 9.0 to 9.0.2 in October 2015, with a final version for iOS 9.1 in March 2016. Every release in the roughly ten years since has needed a computer, an app, or both after each reboot.
What Calif.io actually showed on the Hexacon stage
The demo was narrow and specific. One iPhone 18 Pro, running iOS 27.0.1. A full reboot in front of the audience. A normal passcode unlock. Then a root shell, uid=0, about two minutes after boot, on a phone with nothing attached to it. The terminal output showed the Darwin 27.0.0 kernel and the T8160 chip, which matches the current Pro hardware. Calif.io released no tool, published no exploit details, and offered no timeline beyond a promise to share more “in due time”.
That restraint is normal for research of this weight, and it has not slowed down interest in iOS 27 itself, which is mid-cycle: the iOS 27.2 release candidate has just landed with its own list of cuts and changes, while the hardware side is equally unsettled, with the standard iPhone 18 reportedly slipping to March 2027. A working untethered exploit drops into the middle of all that as the most wanted artifact in the community.
A jailbreak that survives a reboot is also a warning about persistence
Restarting a device is the oldest fix in computing. It clears whatever is resident in memory and resets a suspect system to a known-good state, which is why “turn it off and on again” is the first advice for everything from a frozen app to a suspected compromise. Persistence breaks that assumption. A modification that re-establishes itself at every boot cannot be shaken off by the one remedy everyone knows.
That is why this class of work matters well beyond the hobbyist scene. The early-boot persistence that makes an untethered jailbreak delightful for enthusiasts is the same property that makes advanced spyware so dangerous when it achieves it. When researchers demonstrate the technique on current hardware, running the current OS, defenders pay attention, because they are watching a proof that the hardest door in the building can still be opened.
There is no download, and anyone offering you one is lying
To be plain about it: Calif.io demonstrated research on a single device. There is no public tool, no release date, and no guarantee one ever appears. History says the gap between a stage demo and a usable release is where the scams breed, and fake jailbreak sites are already a genre unto themselves. If a website offers you an iOS 27 untethered jailbreak today, close the tab.
What the Paris demo does change is the vocabulary. For about a decade, “untethered” has been a history word, something the old-timers described while everyone else re-ran an app after every reboot. As of October 16, it is a present-tense word again, attached to an iPhone 18 Pro, a root prompt, and a progress bar nobody had to watch twice.
