One of the two iOS 27 jailbreaks that surfaced this month is now public, just not in the way anyone hoped. Security researcher Johnny, who posts as @0xjohnny, has open-sourced CryptSn0w, the project behind the private TSS/Cryptex jailbreak that Apple killed with a server-side patch on October 9. The code is on GitHub under a name that says everything about its status: “Obsolete iOS jailbreak research using the now-patched TSS/Cryptex bug. Source shared for educational purposes. Not a new jailbreak release.”
Read that last sentence twice before you go looking for a download link. This is not a tool. It does not work anymore, and it cannot be made to work, because the bug it relied on lived on Apple’s servers, and Apple closed it for every iPhone on the planet at once.
What CryptSn0w actually was
The README is unusually generous for jailbreak research, and it explains the mechanism in plain terms. CryptSn0w packaged an SBInject-based jailbreak as a device-personalized Cryptex: a disk image bundled with a trust cache and an Apple signing ticket. The installer obtained that ticket from Apple’s own signing service, which meant the phone accepted a privileged component it would normally reject.
The package was complete. It carried SpringBoard and Settings tweak injection through ElleKit, the Sileo package manager, PreferenceLoader, optional root SSH access, and a macOS installer app. The bootstrap even included code to restore its services after a reboot, which is why ONE Jailbreak describes it as an obsolete untethered jailbreak for iOS 27 and below on A20 Pro and earlier chips.
On Johnny’s own iPhone 18 Pro Max, running iOS 27.2 beta 3, the screenshots showed the familiar signs of a working setup: Sileo, TrollStore Lite, and CocoaTop on the home screen, root filesystem access, and decrypted App Store IPAs. He later called the result a semi-jailbreak, writing that root access is not the same as a stable, full jailbreak. Getting even a handful of tweaks running on iOS 27, he said, took serious work on top of ordinary compatibility problems.
The bug was in Apple’s signing server, not the iPhone
Here is the part that made researchers sit up. Follow-ups from Johnny were explicit about what this was not: no new kernel exploit, no SPTM bypass, no kernel read or write primitive. The weakness sat in Apple’s TSS, the Tatsu Signing Server, the service that signs firmware tickets and cryptexes, the signed OS component images the system is allowed to load.
A flaw at that layer can authorize a privileged component the device would otherwise reject. That is a completely different route from the memory-corruption bugs most jailbreaks depend on, and it explains why Apple could end it without shipping an iOS update. Because the flaw lived on Apple’s servers, Apple fixed it for every device simultaneously. Lars Fröder, the Dopamine jailbreak developer known as opa334, called it the craziest bug he had seen in ten years in the iOS scene.
It also explains why the jailbreak stayed private. Johnny said the bug was kept quiet because a public release would have been patched almost immediately. He called the project cooked once Apple moved. He was right: publicity is what ended it.
87 commits of history, now a textbook
The repository itself is the story’s real value. It holds 87 commits dating back to September, a full source layout, documentation images, a macOS installer, and a section on redactions, the parts Johnny stripped before publishing. At last count it had drawn 175 stars and 25 forks, which for a project its author labels obsolete is a strong signal of how hungry the research community is for real iOS 27 internals.
That hunger is understandable. Public, well-documented jailbreak code for current iOS versions is rare, because working exploits are worth more silent than published. CryptSn0w is the opposite trade: a dead exploit, fully documented, free to study. For anyone learning how Apple’s signing infrastructure actually works, it is now one of the best primary sources available.
Two jailbreaks, two fates
October has now produced two distinct iOS 27 jailbreak stories with opposite endings. CryptSn0w died on October 9 when Apple patched its server-side bug, and its author has now published the remains. Calif.io’s untethered jailbreak, demonstrated live on stage in Paris on October 16, survives a full reboot on an iPhone 18 Pro running iOS 27.0.1, and Apple has still said nothing about it. One relied on Apple’s servers and died by Apple’s servers. The other lives on the device itself, its bugs undisclosed, which is exactly why Apple cannot kill it the same way.
The practical takeaway has not changed. There is no iOS 27 jailbreak you can download today. CryptSn0w is educational code for researchers, not a tool, and iOS 27.2 is about to redraw the map again when it ships next week. Any website offering an “iOS 27 jailbreak download” right now is a scam. We explained what “untethered” actually means and why it matters, and the distinction is doing real work this month: the jailbreak that could survive a reboot is the one Apple still cannot touch.
