Most jailbreak demos end the moment someone presses the power button. The one security firm Calif.io ran on stage at Hexacon in Paris on Friday did the opposite. The team rebooted an iPhone 18 Pro running iOS 27.0.1 in front of a live audience, typed in the passcode, and the jailbreak simply came back, no laptop, no cable, no second exploit run. Then they opened an SSH session on port 2222, logged in as root, and let the terminal answer the only question that mattered: id returned uid=0.
Hexacon is an offensive security conference in Paris organized by Synacktiv, and the demo landed during the opening keynote from Bruce Dang, a former Apple iOS security engineer, and Thai Duong, known in the scene as XorNinja. Researcher Billy Ellis filmed the session, and the footage has been picked apart frame by frame since. Calif.io later posted the clip to X with a caption that doubled as a challenge: “Can your iPhone do this?”
The reboot is the detail that changes everything
Jailbreaks of the last decade have mostly been tethered or semi-tethered. Reboot the phone and the hack evaporates, leaving you to re-run an app or plug into a computer. An untethered jailbreak installs itself deeply enough to survive a full restart, which is why the technique has been considered close to extinct on modern iPhones. The last widely used untethered jailbreaks date back to the iOS 9 era, roughly ten years ago.
Calif.io’s demo showed the full sequence working end to end. The iPhone 18 Pro restarted, the passcode unlocked it as normal, and the jailbreak state restored itself automatically. For a research audience, that sequence is the difference between a neat party trick and a complete defeat of the boot chain, the part of iOS security Apple guards most aggressively.
uid=0 on port 2222: what the terminal actually showed
The close-ups in Ellis’s video are unusually specific, and they are worth listing because they pin the demo to a real device on a real build:
- Kernel: Darwin 27.0.0, XNU build 13432.2.10
- Chip: T8160, the A-series silicon inside the iPhone 18 Pro
- Model: iPhone19,2
- Software: iOS 27.0.1, build 24A446
- 67 packages installed through dpkg, the Debian package tool jailbreaks rely on
- Uptime of about two minutes at the moment of the SSH login, consistent with a fresh reboot
None of that proves which vulnerabilities were used, and Calif.io is not saying. But the details match the shipping hardware and the current public release of iOS, which rules out the usual suspicions about a doctored device or an old, already patched build.
No tool, no bug list, no release date
Anyone hoping to download something should stop here. Calif.io has not named the vulnerabilities, published a write-up, or released a jailbreak tool. A conference newsletter said the findings “will be released in due time,” which in security research usually means after Apple has had a chance to patch, or after the team presents the work in full.
The jailbreak was also not the team’s only demo. Calif.io showed one-click attacks delivered through Signal and through iMessage during the same appearance, the kind of message based exploits that need no link tapping, no attachment opening, and no visible warning on the target phone. Taken together, the demos suggest the team is holding a chain of bugs that reaches from a text message all the way to persistent root access.
iOS 27.0.1 fixed Face ID restarts, not this
There is currently no patch to install. iOS 27.0.1, released on September 28, is still the newest iPhone update, and its release notes listed no security fixes at all. The update existed to fix Face ID related restarts. Whatever Calif.io used on stage is, as far as anyone outside the team knows, still open.
That is a sharp contrast with iOS 27 itself, which shipped on September 14 with fixes for more than 120 vulnerabilities, 20 of them in the kernel. The open question is whether the upcoming iOS 27.2, which has just reached release candidate stage, quietly closes any of these holes. We covered what changed in the iOS 27.2 release candidate earlier this week, and its public notes say nothing about a jailbreak fix. The same update is better known for feature work like the major CarPlay upgrade in iOS 27.
What iPhone owners should actually do
For most people the practical answer is boring, and it is also the correct one. Turn on Automatic Updates under Settings, General, Software Update, so the fix installs the day Apple ships it instead of weeks later. Anyone at genuinely high risk, journalists, activists, executives handling sensitive material, should consider Lockdown Mode, which shuts down several of the attack surfaces message based exploits depend on.
And a warning that never gets old: any website now offering an “iOS 27 jailbreak download” is a scam. There is no tool. Calif.io demoed research on a stage in Paris, and the honest status is that a small team of researchers can fully and persistently own the newest iPhone, Apple has not patched it yet, and everyone else is waiting to find out how they did it.
