In September, one of the world’s biggest phone-forensics companies told its enterprise customers the iPhone jailbreak era was over. On October 16, an untethered jailbreak ran on an iPhone 18 Pro, on the latest iOS, live on stage in Paris. One of those two things is now embarrassing.
The claim, in Cellebrite’s own words
The whitepaper, published September 18 and updated September 22, is the Corellium Mobile Security Playbook on Cellebrite’s own site. In it, the company told enterprise customers that “no current physical devices running iOS latest versions can be jailbroken (iOS 18 and above).” The context matters: the whitepaper is co-marketed with Corellium, which sells virtual iPhones for security testing, and the line is part of a pitch for virtual devices, not the result of a lab experiment. It is a sales claim. It was still wrong within a month.
Calif.io’s October 16 demonstration at Hexacon Paris showed an iPhone 18 Pro on iOS 27.0.1 rebooting into a full untethered jailbreak, root shell over SSH and all, the first such demo since the iOS 9 era. We reported the demo as it happened. It does not matter that no tool has been released yet. The claim was about what is possible, not what is shipping, and Paris just falsified it.
The forensics arms race is very much alive
If anything, the forensics industry is having a busy month. On October 20, Bruce Schneier reported on a leaked Cellebrite document describing “Advanced Unlocks,” a new 2026 “next-generation AFU vector that is more resilient to Apple’s OS changes.” The document describes the unlock working with Stolen Device Protection turned on, delivered through a dedicated appliance with a stated range of about eight meters. The underlying vulnerability may be a radio zero-day. Cellebrite has not confirmed the document publicly.
Read those two stories together and the picture sharpens. One week a forensics giant says current iPhones cannot be jailbroken; the next week its leaked roadmap shows it investing in new physical-access attack hardware. The “jailbreak is dead” line was never a description of the state of the art. It was a description of one company’s product catalog.
Why a jailbreak and an unlock sell in the same market
There is a reason this angle matters beyond scorekeeping. A reliable root exploit chain on a fully updated iPhone is the same class of capability that commercial spyware vendors sell to governments. Decrypt made exactly this point in its coverage of the Paris demo: what Calif showed on stage is, functionally, the capability that firms like NSO Group or its successors turn into products.
That is the market Cellebrite operates in. The company sells to law enforcement and intelligence agencies, and its pitch has long rested on the idea that it can get into phones nobody else can open. A public, reproducible untethered jailbreak on the newest iPhone undercuts that story twice over: it proves the capability exists outside its labs, and it eventually puts a version of it in the hands of every researcher, competitor, and criminal willing to use it.
None of this is to say Cellebrite’s products do not work. Its enterprise playbook documents a serious, ongoing business. But the September whitepaper’s framing, that physical jailbreaks of current iPhones are a thing of the past, did not survive contact with October. And the leaked Advanced Unlocks document suggests the company knows it, even if the marketing has not caught up.
What this means for everyone else
For ordinary iPhone owners, the forensics market is mostly invisible, but its existence shapes the threats you face. Every exploit chain that enters this ecosystem eventually gets studied, copied, and sometimes leaked. Our analysis of how AI assistance sped up this jailbreak made the broader point: the tooling for finding these bugs is getting better, and the pace of the arms race is increasing, not slowing.
The practical takeaway has not changed. Apple has not commented on the demo and has not shipped a patch, and the iOS 27.2 release candidate is the next thing to watch. If you are a likely target of a sophisticated attacker, Lockdown Mode remains Apple’s strongest built-in defense. For everyone else, the normal advice holds: keep iOS updated and do not install profiles or tools from strangers promising early jailbreak access.
