Calif Lockdown Mode bypass on iPhone 18 Pro via malicious AirDrop PDF; jailbreak persists through iOS 27.2
Apple iOS (Lockdown Mode) on iPhone 18 Pro / recent iPhones
Sponsored
Brought to you byTinkerer Club
The private club for people who own their servers, run their own AI, and pay $0/month for software.
Research group Calif posted a Nov 3 2026 demo of jailbreaking an iPhone 18 Pro with Lockdown Mode enabled. The video shows a malicious PDF delivered over AirDrop that the user accepts and opens; after that, installing iOS 27.2 leaves the jailbreak in place. Calif has not published technical details, says it is disclosing the bugs to Apple, and says it will not release a public jailbreak tool. It is unclear from the demo whether a device already on iOS 27.2 can be newly compromised. Apple had told TechCrunch earlier that it was not aware of successful mercenary spyware attacks against Lockdown Mode-enabled devices.
Why this severity: Research demo requiring accepting an AirDrop PDF; Calif disclosing to Apple; not confirmed as in-the-wild mercenary spyware
- Started
- Nov 3, 2026
Affected
- iOS versions prior to 27.2 used for initial compromise in Calif's demo
- Persistence observed after updating to iOS 27.2 (unclear if 27.2 is vulnerable to initial install)
Fixed in
No fixed release yet
Timeline3
Privacy Guides summarizes the Calif Lockdown Mode bypass demo and persistence through iOS 27.2.
Calif posts a Lockdown Mode bypass demo video: malicious AirDrop PDF accepted and opened on iPhone 18 Pro; jailbreak persists through iOS 27.2.
MacRumors covers Calif's Lockdown Mode demo; Calif says it is disclosing the bugs to Apple and will not release a public jailbreak tool.
News & write-ups3
Posts1
Lockdown Mode helps, until it doesn't.
Notes & caveats
This is a separate research demo from the DeadTag/Coruna/DarkSword drive-by kits tracked in deadtag-coruna-darksword-iphone-exploits. Practical mitigation until Apple ships a fix includes setting AirDrop to Contacts Only / off and keeping Lockdown Mode on for high-risk users even though this demo shows a gap.
Get an email when a new major security incident drops. No spam, unsubscribe any time.
