iPhone Jailbreak Bypasses Lockdown Mode and Survives iOS Update

Just over a week after demonstrating an initial jailbreak on launch day, hacker team Calif has returned with an even more striking technical achievement. The group successfully jailbroken an iPhone running Apple's high-security Lockdown Mode, with the modifications remaining active even after updating the operating system.

• Hacker team Calif showcased a jailbroken iPhone 18 Pro while Lockdown Mode was enabled.
• The jailbroken device successfully installed iOS 27.2, and the modifications persisted after the update.
• The exploit is initiated via a malicious PDF file sent through AirDrop and accepted by the target user.
• Calif stated it is disclosing vulnerabilities responsibly to Apple and has no plans to release a public tool.

Bypassing Apple's Extreme Protection

Apple describes Lockdown Mode as an extreme protection feature designed for individuals who might face sophisticated mercenary spyware threats. The mode disables numerous features, including blocking most message attachments, limiting advanced web technologies, restricting unknown FaceTime calls, and stripping location metadata from photos. However, the new demonstration highlights that even these robust safeguards can face sophisticated bypasses.

The demonstration video shows a malicious PDF sent to the target iPhone via AirDrop to kick off the jailbreak process once the user accepts the file. It remains unclear whether this specific exploit chain could be leveraged on a device that is already running iOS 27.2 prior to the initial compromise.

Security Context and Apple's Position

Earlier this year, Apple informed the media that it had no record of any successful mercenary spyware attacks against an iPhone operating in Lockdown Mode. Calif's demonstration challenges the perceived invulnerability of the feature, though the attack vector still relies on user interaction via file acceptance.

Calif previously stated that it follows responsible disclosure practices by sharing vulnerability details directly with Apple. The team reiterated that it does not intend to package these exploits into a consumer-facing jailbreak utility, meaning end users are not facing an immediate wave of public exploits.

Implications for Developers and Security

For users, developers, and security researchers, this demonstration serves as a reminder that absolute software security remains an ongoing challenge. While Lockdown Mode significantly raises the bar against indiscriminate or targeted spyware, advanced adversaries continue to probe deep OS architectures for bypass vectors.

For Apple and the wider tech ecosystem, such research provides valuable insights into wireless transmission vectors like AirDrop and document parsing engines. Coordinated disclosure helps engineering teams patch underlying weaknesses in subsequent iOS releases to protect high-risk users.