It’s a pity we gave in to the “ecosystem” play by these huge companies.. even if I jailbreak my iOS and never let it update.. Apple can easily detect the jailbreak and lock me out of anything iCloud, and iMessage and such. iPhone would be one glorious iPod touch after that.. :-(
Seeing all these gives me the same energy of early days of jailbroken Android phones where one could become root and do whatever with the hardware…
I stopped considering such tinkering because I got tired of finding those little tweaks and fixes on forums like xda every time something was updated. With the LLMs capable of automating that tool, I might find those old school way of mobile phones again…
My favourite part from the first video is how much effort it took to drag up from the bottom of the screen to get back to the home-screen. This reflects my experience with how iOS handles touch gestures in general.. also super easy to accidentally activate "Reachability" mode!
Subverting the secure boot/upgrade chain would require a SecureROM exploit and presumably a compromise of the Secure Enclave, so the answer is almost certainly "no" (even prior major exploits from recent memory like usbliter8 are tethered and don't exploit the enclave; the last true untethered Jailbreak was iOS 9 or something.) An upgrade would fix it. The internet reporting claims this break they are showing in this video is untethered though, which is extremely rare on its own.
The videos sort of imply that these are userland rather than bootrom, whatever payload they have running is getting hit before first unlock, which isn't a lot of surface. They specifically say to not update which pretty much confirms where the attack surface is. Somewhere after the kernel starts but before the main user space is unlocked with the passcode.
Is it an exploit around the library that handles PDF parsing/opening? Can someone explain how files / attachement are open on a mobile device ( android/iPhone).
I don't understand how in 2026 this is still a thing, we have many safe languages to parse/deserialize data. Why is it complicated?
PDFs are executables, that's why it's hard. They support running code, they support decoding images which themselves have their own custom compressors that are also basically code themselves. Anything to do with image formats is rife for bad decoders, insane compression algorithms from the 90s, and a PDF is basically 1000 formats inside many different container types with executable code plastered on everywhere. If you want to make a compatible PDF viewer you'll need to be able to implement an image decoder algorithm for a fax machine that was specific to Japan in the late 80s, which was somehow ratified into a standard and is used today by all the top legal firms, or something absurd like that. When you open a PDF on your computer, depending on how it is being parsed, it can even make outbound network connections without you knowing. To safely open a PDF you need one of those bomb proof suits, a disposable laptop, and even then you might be going home without eyebrows.
Willing to bet that a default "treat PDFs/documents/spreadsheets as dumb" option in operating systems would eliminate the majority of common one-click vulnerabilies out there. And exactly 0.001% of actual use cases would be affected.
PDFs are just absurdly complicated in general. Dumbing down the parser might be the right idea. I wonder what consequences that would have with how intertwined PostScript and PDF in general are with macOS/iOS; maybe that's why the PostScript engine was removed with macOS Sonoma/iOS 17? I don't know if that was only user facing behavior and Apple is still working to remove the internal usages.
I think he just means disable any of the "advanced" features mentioned above like accessing web content, running custom scripts, etc etc. You might still be vulnerable to any dependencies they use for image rendering itself but I bet it would make it drastically more safe.
Then just have a button for turning those on as needed on a case by case basis
I read it more as "don't implement JS, 3D object rendering, slideshow transitions, sound annotations and the other 999 insane features that I'm not even aware exist"
That isn’t really true, it’s not hard for PDF viewers to block by default (or just not implement) the problematic features, which also aren’t critical for the vast majority of PDF files.
The exploitable bugs are typically the usual, some buffer overflow in an underlying image or font library or similar, but unrelated to PDFs being “executable”.
From the standpoint of a layman it looks like there's a lot of overlap between writing safe web browsers/engines and writing safe PDF readers/engines. There just hasn't been anywhere near as much of an impetus to push PDF readers/engines in that direction because most of us aren't interacting with PDFs nearly as often as we interact with the web (and things built on web tech).
I can 100% guarantee that we'll have comments from people saying they buy iPhones specifically because of the walled garden and the last thing they want is a jail broken device. On a website called Hacker News.
I converted to an iphone 13 mini (from the S24 Ultra) after being on Android since the release of the HTC Desire in 2010. I used to install custom roms and tweak everything on all of my Android phones which actually lead me to the iphone because I realized I wanted a phone without all the OE clutter and Google crap. The only clutter on the iphone is icloud which stays out of the way and doesn't annoy me with subscription messages. Also I don't have time to fuck around with modifying my phone. I just want everything to work without user intervention.
Having control over one's device and allowing anything and everything to have free reign on said device are two different things.
I'd love to have more control and customizability that the user can initiate, but random executables shouldn't be able to so much as sneeze without my permission. Third party software (yes, even the FLOSS variety due to issues such as supply chain compromises) must be treated as adversarial by default, anything less is foolishness.
But to jailbreak you need to stay on an older iOS version (because Apple patches the bugs enabling the jailbreaks). And that means you don't get security updates.
Earlier today on the thread about the google play store apocalypse I posted a comment saying that I like some things about life in Apple's walled garden. But I still upvoted the parent comment because it's true and it's funny.
Also I'd happily jailbreak my iPhone and put an alternative OS on it to extend its lifespan. I'm a living human with nuanced opinions and I'm allowed to like more than one thing.
I'm glad to confirm your suspicion. I like to have both a walled-garden phone and several open-platform computers. They do two completely different things for me.
To be honest, I'd like my open computers to be even more open and hackable, with a secure boot path that doesn't involve any mysterious unpatchable embedded firmware or auxiliary CPUs, but we are slowly getting there with RISC V.
I want the same kind of phone. But I reject the premise that it's impossible to have a deeply nested "De-wall this device yes I know what I am doing yes I confirm I'm about to really open myself to issues if I don't understand the implications" settings option without compromising the walled mode security.
The point is that no one forces you to jailbreak your iPhone. If you like the walled garden - great! Keep using it! But I've been in plenty of discussions where iPhone users are literally against jailbreaks at all and in any form.
I'm for being able to hack your own device to do whatever you like with it, preferably without active resistance from its manufacturer. I'm against anybody who can convince you to open a PDF being able to hack your device to do whatever they like with it.
> I'm against anybody who can convince you to open a PDF being able to hack your device to do whatever they like with it.
Who is saying this part?
Asking for an open device does not mean supporting malicious hacking of others. This is the single biggest false equivalence used by Apple and the rest of the industry to keep a closed ecosystem and restrict users' control over stuff they paid for, and people keep perpetuating it for some reason.
Noob q: Does this(and most) hacks like this on the iphone likely rely on some kernel module — or what it talks to for executing code — being compromised to run arbitrary code execution? I dunno about ios but it seems from the videos that something that reads imessage attachments was compromised for privilege escalation.
Like what im mean is an attack vector shaped similar to https://pepsipu.com/blog/2026-10-switch2-jailbreak-ns2jb/ i.e. they compromised `fs` module that did not protect against a buffer attack(in memmov)? My understanding is that most core kernel modules are difficult to attack directly because of XOM, PAC and CFI like protections make it impossible for anyone/thing, so most likely only indirect attacks like above can work in such situations — there is a lot of incentive for teams like apple to do everything possible to improve security so i assume only these kind of difficult to find vectors remain.
Craziest part is it was never even intended to be a programming language. From the Wikipedia page, the founder Rasmus Lerdorf is quoted as saying:
"I don't know how to stop it [...] there was never any intent to write a programming language [...] I have absolutely no idea how to write a programming language [...] I just kept adding the next logical step on the way."
And 23 years later here we are with php2shell and it powering 70% of the internet’s websites
Someone correct me please if I’m wrong but is this because iOS doesn’t sandbox their processes? I think I read Safari in particular doesn’t, but wonder if this is system-wide issue.
The more of this stuff we see, the more people will start using GrapheneOS, I guess.
Also wonder why they choose to publish and not cash-in the Apple bounty..
I'm not sure if this is real, but if it is: this week is unbelievable. I really hope it's not the new normal, but unfortunately I don't believe this myself.
There's every incentive for nation states and other espionage outfits to keep these types of exploits under wraps. This has probably been the new normal for some time ..
I for one have experienced multiple lifetimes worth of internet madness and will be looking to airgap / disconnect as many devices as I can get away with.
I think in time (a few years) the gap will close a bit. As AI is used to harden software, it will be harder to break. Software not validated by AI will continue to be vulnerable to it.
My dream is to release an iOS app that self-installs and not say anything special about it other than having a "Download for iPhone" button on my website. If someone asked me, I'd answer: "Huh, what do you mean? It's our app for the iPhone."
I think we will probably see more and more restrictions on frontier models in the coming months. This is not what behemoths like Apple and Sony want to see.
Paradoxically, people are happier to buy things that they have control over, but boy, Apple loves to control every layer of consumerism.
If the current frontier allows for this, we can probably expect alternative models to reach the same spot in a matter of months as well. The cat's out of the bag, for better of worse.
Too bad this will be patched instead of allowing the device owner to control their own device.
Of course it's better that they found that before some shady mercenary spyware company, but I'd also want to control my ios device the same way they did in the video, but no, that's not for us.
It’s a pity we gave in to the “ecosystem” play by these huge companies.. even if I jailbreak my iOS and never let it update.. Apple can easily detect the jailbreak and lock me out of anything iCloud, and iMessage and such. iPhone would be one glorious iPod touch after that.. :-(
Seeing all these gives me the same energy of early days of jailbroken Android phones where one could become root and do whatever with the hardware… I stopped considering such tinkering because I got tired of finding those little tweaks and fixes on forums like xda every time something was updated. With the LLMs capable of automating that tool, I might find those old school way of mobile phones again…
the videos just don't hit the same without the dancing anime girl and the electronic dance music.
https://x.com/calif_io/status/2113570095549337977
My favourite part from the first video is how much effort it took to drag up from the bottom of the screen to get back to the home-screen. This reflects my experience with how iOS handles touch gestures in general.. also super easy to accidentally activate "Reachability" mode!
The reason they're having trouble is because they're in the simulator.
Also, if reachability bothers you like it does me, you can disable it.
#3 is so nice, I want root access to my phone. Does anyone know if doing this can lock Apple out from updating/removing it?
Subverting the secure boot/upgrade chain would require a SecureROM exploit and presumably a compromise of the Secure Enclave, so the answer is almost certainly "no" (even prior major exploits from recent memory like usbliter8 are tethered and don't exploit the enclave; the last true untethered Jailbreak was iOS 9 or something.) An upgrade would fix it. The internet reporting claims this break they are showing in this video is untethered though, which is extremely rare on its own.
The videos sort of imply that these are userland rather than bootrom, whatever payload they have running is getting hit before first unlock, which isn't a lot of surface. They specifically say to not update which pretty much confirms where the attack surface is. Somewhere after the kernel starts but before the main user space is unlocked with the passcode.
Is it an exploit around the library that handles PDF parsing/opening? Can someone explain how files / attachement are open on a mobile device ( android/iPhone).
I don't understand how in 2026 this is still a thing, we have many safe languages to parse/deserialize data. Why is it complicated?
PDFs are executables, that's why it's hard. They support running code, they support decoding images which themselves have their own custom compressors that are also basically code themselves. Anything to do with image formats is rife for bad decoders, insane compression algorithms from the 90s, and a PDF is basically 1000 formats inside many different container types with executable code plastered on everywhere. If you want to make a compatible PDF viewer you'll need to be able to implement an image decoder algorithm for a fax machine that was specific to Japan in the late 80s, which was somehow ratified into a standard and is used today by all the top legal firms, or something absurd like that. When you open a PDF on your computer, depending on how it is being parsed, it can even make outbound network connections without you knowing. To safely open a PDF you need one of those bomb proof suits, a disposable laptop, and even then you might be going home without eyebrows.
> PDFs are executables, that's why it's hard. They support running code
I don't think Apple's PDF renderer supports e.g. running JS, you'd need real Acrobat for that. Or are you talking about something else?
> they support decoding images which themselves have their own custom compressors that are also basically code themselves.
But this is fundamentally true for anything that displays images, right? Or are the PDF formats particularly bad for some reason?
Willing to bet that a default "treat PDFs/documents/spreadsheets as dumb" option in operating systems would eliminate the majority of common one-click vulnerabilies out there. And exactly 0.001% of actual use cases would be affected.
PDFs are just absurdly complicated in general. Dumbing down the parser might be the right idea. I wonder what consequences that would have with how intertwined PostScript and PDF in general are with macOS/iOS; maybe that's why the PostScript engine was removed with macOS Sonoma/iOS 17? I don't know if that was only user facing behavior and Apple is still working to remove the internal usages.
"dumb" isn't a real thing in computer science though. You mean render them to bitmaps in a sandbox?
I think he just means disable any of the "advanced" features mentioned above like accessing web content, running custom scripts, etc etc. You might still be vulnerable to any dependencies they use for image rendering itself but I bet it would make it drastically more safe.
Then just have a button for turning those on as needed on a case by case basis
I read it more as "don't implement JS, 3D object rendering, slideshow transitions, sound annotations and the other 999 insane features that I'm not even aware exist"
Did we do that with Excel spreadsheets so that macros are disabled by default?
> PDFs are executables, that's why it's hard.
That isn’t really true, it’s not hard for PDF viewers to block by default (or just not implement) the problematic features, which also aren’t critical for the vast majority of PDF files.
The exploitable bugs are typically the usual, some buffer overflow in an underlying image or font library or similar, but unrelated to PDFs being “executable”.
From the standpoint of a layman it looks like there's a lot of overlap between writing safe web browsers/engines and writing safe PDF readers/engines. There just hasn't been anywhere near as much of an impetus to push PDF readers/engines in that direction because most of us aren't interacting with PDFs nearly as often as we interact with the web (and things built on web tech).
Most web browsers actually make decent PDF viewers by default don't they ?
Ok so you became "root", but who knows, Apple might have "superroot" and if that is not enough "god-mode".
Hoping more "unsupported" older "iDevices" can be made usable with newer software with something like "jailbreaking"
It's a felony to subvert the natural order of disposable tech consumerism.
I can 100% guarantee that we'll have comments from people saying they buy iPhones specifically because of the walled garden and the last thing they want is a jail broken device. On a website called Hacker News.
I converted to an iphone 13 mini (from the S24 Ultra) after being on Android since the release of the HTC Desire in 2010. I used to install custom roms and tweak everything on all of my Android phones which actually lead me to the iphone because I realized I wanted a phone without all the OE clutter and Google crap. The only clutter on the iphone is icloud which stays out of the way and doesn't annoy me with subscription messages. Also I don't have time to fuck around with modifying my phone. I just want everything to work without user intervention.
And you can keep doing that, no once forces you to jailbreak.
Having control over one's device and allowing anything and everything to have free reign on said device are two different things.
I'd love to have more control and customizability that the user can initiate, but random executables shouldn't be able to so much as sneeze without my permission. Third party software (yes, even the FLOSS variety due to issues such as supply chain compromises) must be treated as adversarial by default, anything less is foolishness.
I like jailbreaks.
But to jailbreak you need to stay on an older iOS version (because Apple patches the bugs enabling the jailbreaks). And that means you don't get security updates.
Earlier today on the thread about the google play store apocalypse I posted a comment saying that I like some things about life in Apple's walled garden. But I still upvoted the parent comment because it's true and it's funny.
Also I'd happily jailbreak my iPhone and put an alternative OS on it to extend its lifespan. I'm a living human with nuanced opinions and I'm allowed to like more than one thing.
I'm glad to confirm your suspicion. I like to have both a walled-garden phone and several open-platform computers. They do two completely different things for me.
To be honest, I'd like my open computers to be even more open and hackable, with a secure boot path that doesn't involve any mysterious unpatchable embedded firmware or auxiliary CPUs, but we are slowly getting there with RISC V.
I want the same kind of phone. But I reject the premise that it's impossible to have a deeply nested "De-wall this device yes I know what I am doing yes I confirm I'm about to really open myself to issues if I don't understand the implications" settings option without compromising the walled mode security.
The point is that no one forces you to jailbreak your iPhone. If you like the walled garden - great! Keep using it! But I've been in plenty of discussions where iPhone users are literally against jailbreaks at all and in any form.
The meaning of Hacker here is VC Startup Founder
You said what I was thinking. If anyone has links for _hacker_ news drop them here ;)
It’s reasonable to like to hack things, but to want a phone that just works.
Man, sucks to see these "hacked" iPhones doing so many cooler things than my Apple-approved one.
I'm for being able to hack your own device to do whatever you like with it, preferably without active resistance from its manufacturer. I'm against anybody who can convince you to open a PDF being able to hack your device to do whatever they like with it.
Who is saying this?
The link here demonstrates an exploit which runs arbitrary code on an iPhone when the user opens a PDF.
> I'm against anybody who can convince you to open a PDF being able to hack your device to do whatever they like with it.
Who is saying this part?
Asking for an open device does not mean supporting malicious hacking of others. This is the single biggest false equivalence used by Apple and the rest of the industry to keep a closed ecosystem and restrict users' control over stuff they paid for, and people keep perpetuating it for some reason.
iOS has enough zero-click exploits that you don't exactly get a choice between the two.
You don't get that choice on any mobile platform.
Noob q: Does this(and most) hacks like this on the iphone likely rely on some kernel module — or what it talks to for executing code — being compromised to run arbitrary code execution? I dunno about ios but it seems from the videos that something that reads imessage attachments was compromised for privilege escalation.
Like what im mean is an attack vector shaped similar to https://pepsipu.com/blog/2026-10-switch2-jailbreak-ns2jb/ i.e. they compromised `fs` module that did not protect against a buffer attack(in memmov)? My understanding is that most core kernel modules are difficult to attack directly because of XOM, PAC and CFI like protections make it impossible for anyone/thing, so most likely only indirect attacks like above can work in such situations — there is a lot of incentive for teams like apple to do everything possible to improve security so i assume only these kind of difficult to find vectors remain.
Same guys who found the PHP.
Edit: hahaha you guys are funny. “The php hack” is what I meant!
They found the PHP?
Yes, actually PHP was not invented but discovered in nature. That’s why it’s a bit wild sometimes, because it still remembers its origins.
PHP was born as a templating language, but mutated into a programming language, and then grew organically from there.
Craziest part is it was never even intended to be a programming language. From the Wikipedia page, the founder Rasmus Lerdorf is quoted as saying:
"I don't know how to stop it [...] there was never any intent to write a programming language [...] I have absolutely no idea how to write a programming language [...] I just kept adding the next logical step on the way."
And 23 years later here we are with php2shell and it powering 70% of the internet’s websites
Everything becomes a programming language in due time. At work we have YAML files with #if and #include statements…
Does that mean eventually a programming language becomes a crab or a crab becomes a programming language?
But that only raises the question: what bore PHP? A bit of a C(hicken) and an egg situation.
I am reasonably certain PHP is not written in Chicken.
https://en.wikipedia.org/wiki/Chicken_(Scheme_implementation...
I mean there's no way there was any intelligent design behind it
/ducks and runs
Didn't know that the PHP was lost, thanks for pointing that out.
They found the PHP vulnerability that has upended the world, or so it seems.
The Princely Hippopotamus Parlor in this case.
Someone correct me please if I’m wrong but is this because iOS doesn’t sandbox their processes? I think I read Safari in particular doesn’t, but wonder if this is system-wide issue.
The more of this stuff we see, the more people will start using GrapheneOS, I guess.
Also wonder why they choose to publish and not cash-in the Apple bounty..
How did they bypass MTE? Wasn't it suppose to make such exploits basically impossible?
Oh boy, what a week. Must be great working in cybersec right now.
More details: https://onejailbreak.com/blog/iphone-duo-ios-27-1-jailbreak-...
Apple doesn't use AI to vibecode and/or pentest their software?
I think we have a right to know.
Stay on 27.0 or upgrade to 27.0.1?
guess who put themselves on the must-hack list of every single national intelligence agency
Eli5 the iMessage video? They open a file that calls their webapp?
What are these videos actually demonstrating?
Right that does it. I'm fucking off to the pub and drinking myself under the table after this week.
I'm not sure if this is real, but if it is: this week is unbelievable. I really hope it's not the new normal, but unfortunately I don't believe this myself.
It's a minuscule part of the new normal.
There's every incentive for nation states and other espionage outfits to keep these types of exploits under wraps. This has probably been the new normal for some time ..
I for one have experienced multiple lifetimes worth of internet madness and will be looking to airgap / disconnect as many devices as I can get away with.
I think in time (a few years) the gap will close a bit. As AI is used to harden software, it will be harder to break. Software not validated by AI will continue to be vulnerable to it.
My dream is to release an iOS app that self-installs and not say anything special about it other than having a "Download for iPhone" button on my website. If someone asked me, I'd answer: "Huh, what do you mean? It's our app for the iPhone."
You can do this on Android
Not for long now...
I think we will probably see more and more restrictions on frontier models in the coming months. This is not what behemoths like Apple and Sony want to see.
Paradoxically, people are happier to buy things that they have control over, but boy, Apple loves to control every layer of consumerism.
If the current frontier allows for this, we can probably expect alternative models to reach the same spot in a matter of months as well. The cat's out of the bag, for better of worse.
Oct 16th post;
More recently: iPhone Duo Jailbreak vid https://x.com/calif_io/status/2113570095549337977 (https://news.ycombinator.com/item?id=50206680)
Too bad this will be patched instead of allowing the device owner to control their own device.
Of course it's better that they found that before some shady mercenary spyware company, but I'd also want to control my ios device the same way they did in the video, but no, that's not for us.
In principle it should be possible to jailbreak-patch the OS so that it will patch any patches to your liking.
Curious to see how many tokens was spent