Overview
- A hacker group called Calif posted a video earlier this week showing an iPhone 18 Pro with Lockdown Mode enabled receive an AirDropped PDF, the user open the file, install iOS 27.2, and then appear to retain jailbreak access after the update.
- The demonstration implies the exploit relied on a social‑engineering step—accepting and viewing an AirDropped PDF—to trigger code execution despite Lockdown Mode’s restrictions on message attachments and web content.
- Calif says it privately disclosed the underlying vulnerabilities to Apple and will not publish a consumer jailbreak tool, but Apple has not yet issued a public technical response or patch and outside researchers have not independently verified the video.
- Persistence through the iOS update suggests the attack either uses an exploit chain that survives an update or installs a persistence mechanism on the device, which means standard software updates may not reliably remove this compromise.
- Lockdown Mode was designed to protect high‑risk people such as politicians and activists by blocking common attack channels, and this development raises questions about how Apple will investigate, fix the flaw, and whether users must change how they accept files and updates.