WORLDWIDE SHIPPING AVAILABLE
Privacy First logoPRIVACY FIRSTPUTTING YOUR PRIVACY FIRST.

IPHONE SECURITY

Hexacon 2026: The iPhone 18 Pro Jailbreak and One-Click Demos Explained

Published 25 October 2026

Audience seated in a dark conference hall under stage lights

Short version: on 16 October 2026, researchers from the security firm Calif showed an untethered jailbreak of an iPhone 18 Pro running iOS 27.0.1 on stage at Hexacon in Paris. They also showed demos of attacks that start with a single tap on a booby-trapped file sent through Signal or iMessage. No tool or exploit code has been released, the bugs haven't been named, and the researchers say most of them are already fixed in Apple's iOS 27.2 beta. For almost everyone, the right response is to install updates promptly, not to panic.

What is Hexacon?

Hexacon is an offensive security conference held each October in Paris and organised by the French security firm Synacktiv. "Offensive" means the talks are about how systems get broken, not just how they are defended: browser exploits, kernel bugs, hardware attacks and full exploit chains. The audience is mostly professional vulnerability researchers.

The 2026 edition ran on 16 and 17 October. The agenda opened with a keynote by Bruce Dang and Thai Duong, both of Calif, about using AI for vulnerability research. Several other talks touched on Apple, including:

Abstracts are on the Hexacon speakers page.

What Calif actually showed

Calif unveiled four demos on stage and posted short captions for them on its newsletter the same day, ending with "Everything will be released in due time." Based on that post, the stage video and reporting by heise online and Decrypt, this is what was shown:

Heise also reports that the chain bypasses Apple's Memory Integrity Enforcement, that a custom app can be used as another way in, and that it is the first jailbreak since iOS 9 to survive a reboot. Calif's Stefan Esser told heise that AI helped develop the jailbreak, but that "pointing a model at an iPhone and telling it to hack it is still science fiction". Expert humans still did the hard part.

Jailbreak researcher Billy Ellis filmed the demo from the audience:

The iOS 27 untethered jailbreak on an iPhone 18 Pro, shown by Calif at Hexacon (filmed by Billy Ellis)
The iOS 27 untethered jailbreak on an iPhone 18 Pro, shown by Calif at Hexacon (filmed by Billy Ellis) (YouTube)

The jargon, in plain English

TermWhat it means
ExploitCode that abuses a bug to make software do something it shouldn't
Exploit chainSeveral exploits used in sequence, because no single bug gets an attacker all the way in
One-clickThe victim has to do one thing, such as tap a link or open a file
Zero-clickNo interaction at all; for example, a malicious message that is processed automatically
Sandbox escapeBreaking out of the walled-off space each app runs in
KernelThe core of the operating system; controlling it means controlling the phone
UntetheredThe jailbreak survives a restart without plugging into a computer

A typical modern iPhone chain looks like this: a bug in whatever opens the malicious content (a PDF renderer or the browser, say) gives code execution inside an app, a second bug escapes that app's sandbox, and a third gains control of the kernel. Along the way the attacker has to defeat hardware defences such as Pointer Authentication (PAC), which signs important memory pointers so they can't simply be forged.

Memory Integrity Enforcement (MIE) is Apple's newest layer, introduced with the iPhone 17 and iPhone Air. As Apple's security research blog explains, it uses hardware memory tagging to catch the kinds of memory corruption most exploits rely on, and it is always on. A reported bypass of MIE on Apple's newest hardware is the main reason researchers took this demo seriously. The details aren't public yet, so it isn't possible to say how general that bypass is.

Jailbreak vs spyware: same tools, different goals

A jailbreak is something you do to your own phone, usually to gain root access, run unapproved software or study iOS. A spyware infection is something done to you, silently, to read your messages, track your location and switch on the microphone.

The technical ingredients are often the same. A chain that roots your own iPhone after one tap on a PDF could, in the wrong hands, root someone else's. That is why researchers watch jailbreaks closely, and why the one-click messaging demos matter more to ordinary users than the jailbreak itself.

The Coruna talk at the same conference showed how this works in practice. Google's Threat Intelligence Group documented Coruna in March 2026: five full iOS exploit chains and 23 exploits, targeting iOS 13 to 17.2.1. It started with a commercial surveillance vendor's customer, was then used in watering-hole attacks on Ukrainian websites, and ended up on fake Chinese finance and crypto sites. Google notes the kit isn't effective against the latest iOS, and that it stops if the iPhone is in Lockdown Mode. Calif's Thai Duong has written up the first stage of that chain.

Are ordinary iPhone users at risk?

For most people, right now, the direct risk is low:

Apple hasn't commented on the demo. Its practice is not to discuss security issues until a fix is available. Apple's iOS 27 security notes do credit Calif, working with Anthropic's Claude, for two separate crash bugs (CVE-2026-65409 and CVE-2026-65410), but nothing links those to the jailbreak.

Bugs like these do get used against real people, however. In September Apple shipped iOS 26.7.1 to fix CVE-2026-86950, a CoreGraphics flaw triggered by a maliciously crafted file, which Apple said "may have been exploited in an extremely sophisticated attack against specific targeted individuals" on versions before iOS 27. Journalists, activists, lawyers, executives and people in high-conflict situations are the usual targets of that kind of attack.

Be wary of anyone offering an "iOS 27 jailbreak" download. No tool exists, and fake jailbreak sites and videos are a common way to push scams and malware.

How to protect your iPhone

  1. Update promptly. Go to Settings, General, Software Update and turn on Automatic Updates. Install the release that contains these fixes as soon as it arrives. Apple lists every patch on its security releases page.
  2. Don't open files or links you weren't expecting, even from people you know. Both messaging demos depend on a single tap on a PDF.
  3. Consider Lockdown Mode if you're a likely target. It's in Settings, Privacy & Security. Apple's Lockdown Mode guide explains what it does: it blocks most message attachment types and limits risky web features, which removes a lot of the attack surface one-click chains use. As Coruna showed, some exploit kits refuse to run on a phone in Lockdown Mode at all.
  4. Restart your phone regularly. Most spyware doesn't survive a reboot, which is exactly why an untethered chain is a big deal. A restart also returns the phone to its most protected locked state; see AFU vs BFU explained.
  5. Check for signs of compromise. Our guide on how to check your phone for spyware covers the warning signs, and you can run our free in-browser spyware scan. For deeper forensic checks, see our upcoming guides to Pegasus spyware and the Mobile Verification Toolkit (MVT).

The bigger picture

The iPhone remains one of the hardest consumer devices to attack. MIE, PAC, fast patching across hundreds of millions of devices and Lockdown Mode are real strengths, and this demo took a top-tier team, AI assistance and serious effort. The lesson isn't that iPhones are insecure. It's that no phone is unbreakable, and updates and habits matter more than the logo on the back.

If you'd like to compare approaches, we've written an even-handed look at GrapheneOS vs iPhone. GrapheneOS uses hardware memory tagging on Pixel phones and offers other hardening, and we sell a GrapheneOS phone set up for privacy for people who want that route.

We'll update this article when Calif publishes its technical write-ups and Apple confirms which update fixes these bugs.

See the GrapheneOS phone→

← Back to Blogs