Today, we hacked what we'd set out to hack: the iPhone

It’s a pity we gave in to the “ecosystem” play by these huge companies.. even if I jailbreak my iOS and never let it update.. Apple can easily detect the jailbreak and lock me out of anything iCloud, and iMessage and such. iPhone would be one glorious iPod touch after that.. :-(

Seeing all these gives me the same energy of early days of jailbroken Android phones where one could become root and do whatever with the hardware… I stopped considering such tinkering because I got tired of finding those little tweaks and fixes on forums like xda every time something was updated. With the LLMs capable of automating that tool, I might find those old school way of mobile phones again…

I just feel a bit sad and impotent that a number of security researchers outside the circle cannot join their "yo we found more crazy bugs" party because simply frontier labs only give access to those models with "Red Team" availability to the inner circle members/companies.

Now their "trusted cyber access" program is moat rather than safeguard.

the videos just don't hit the same without the dancing anime girl and the electronic dance music.

Very cool demos, but now I'm interested to know: does enabling Lockdown mode help at all against these exploits? It'll theoretically protect against a lot of common attack vectors, but I'm curious about its real-life effectiveness.

#3 is so nice, I want root access to my phone. Does anyone know if doing this can lock Apple out from updating/removing it?

What's with iOS and pdfs pwning them? Reminds me of the ForcedEntry in Pegasus.

https://projectzero.google/2022/03/forcedentry-sandbox-escap...

https://www.trendmicro.com/en_gb/research/21/i/analyzing-peg...

Man, sucks to see these "hacked" iPhones doing so many cooler things than my Apple-approved one.

Noob q: Does this(and most) hacks like this on the iphone likely rely on some kernel module — or what it talks to for executing code — being compromised to run arbitrary code execution? I dunno about ios but it seems from the videos that something that reads imessage attachments was compromised for privilege escalation.

Like what im mean is an attack vector shaped similar to https://pepsipu.com/blog/2026-10-switch2-jailbreak-ns2jb/ i.e. they compromised `fs` module that did not protect against a buffer attack(in memmov)? My understanding is that most core kernel modules are difficult to attack directly because of XOM, PAC and CFI like protections make it impossible for anyone/thing, so most likely only indirect attacks like above can work in such situations — there is a lot of incentive for teams like apple to do everything possible to improve security so i assume only these kind of difficult to find vectors remain.