Follow for IOS & Jailbreak news
Joined March 2016
- Tweets13.7K
- Following213
- Followers2.6K
- Likes10.3K
Pinned Tweet
Luca @qwertyuroiopz said that the release will not be Soon about the Pangu iOS 10.3.1 jailbreak
IOSGod retweeted
📢📢 KAMUI — iOS 27.x sandbox escape + MobileGestalt editor
github.com/murk-sus/kamui-es…
IOSGod retweeted
probably Calif’s kernel bug, given that they said next week they probably knew an update was coming
IOSGod retweeted
sandbox escape 0day PoC worse_query disclosed. It targets iOS 26.0–26.7.2, iOS 27.2, and iOS 27.3 beta. Successful exploitation allows access to system paths and modification of app data.
github. com/forcequitOS/worse_query/tree/main
IOSGod retweeted
Introducing worse_query, a zero-day sandbox escape for iOS 26 and 27, again.
In collaboration with @0xjohnny!
github.com/forcequitOS/worse…
IOSGod retweeted
Based on my current research, iOS 27.0.1 appears to be the most stable release and presents several interesting potential vulnerability paths.
However, the real challenge isn't simply discovering vulnerabilities. It's understanding and overcoming SPTM, Apple's security layer, which requires deep kernel-level access and a thorough understanding of the system's security architecture.
A team has announced that they plan to publish their work in this area within a week. Only a few days remain.
Nevertheless, I'm continuing my independent research, exploring different approaches and working toward discovering and validating findings through my own efforts.
First, we need to establish solid kernel-level findings. Then comes the much bigger challenge: SPTM.
The research continues. 🔬
IOSGod retweeted
Yes, of course, all my research and tools are public, check my repo github.com/SKVLENT/iOS27-Res…
IOSGod retweeted
Exploit pdf iOS 27.1 - oob write
github.com/Rust505/CVE-2026-…
IOSGod retweeted
And now: iOS AGX r/w via ClearSword krw.
No, this is not an SPTM bypass. It may help further research, but on its own it cannot access SPTM-protected memory without faulting.
github.com/0xjohnnydev/AGX-R…
IOSGod retweeted
It’s getting complicated.
New macOS 27.0.1 PoC: AGX firmware R/W via PAC callback + pointer reuse, protected GFX PTE control. Built on @alfiecg_dev's KextRW.
macOS only: M4 Pro/Max, base M5 & MacBook Neo. Also works on iOS (DarkSword); PoC coming.
SPTM bypass pls, @calif_io? 😅
github.com/0xjohnnydev/AGX-R…
IOSGod retweeted
New macOS 27.0.1 PoC: AGX firmware R/W via PAC callback + pointer reuse, protected GFX PTE control. Built on @alfiecg_dev's KextRW.
macOS only: M4 Pro/Max, base M5 & MacBook Neo. Also works on iOS (DarkSword); PoC coming.
SPTM bypass pls, @calif_io? 😅
github.com/0xjohnnydev/AGX-R…
IOSGod retweeted
Calif CEO @XorNinja reveals how his team hacked an iPhone and maintained root access even after rebooting or updating the device, challenging one of the most common pieces of iPhone security advice:
"In software security, the iPhone is like the holy grail of vulnerability exploitation."
"Since Apple introduced MIE, which is a hardware mitigation mechanism, since last year, nobody actually has published any public iPhone exploit. So we really, really wanted to hack the iPhone for that reason."
"We managed to get root access to the iPhone and even persistent access."
"In the past people said one of the best practices for iPhone security is to reboot your phone after a while because all the malware would go away."
"But we show that there's ways to persist our attacks even if you reboot or you upgrade your iPhone."
@calif_io
IOSGod retweeted
iOS 27.0.1 kernel panic from one VideoToolbox property
CVE-2026-112705 · AppleAVE2 OOB write → kernel data abort (DoS only)
- NumberOfTemporalLayers=16463 → first encode panics videocodecd (16462 survives)
- PC in AppleAVE2 +0xDA78, far=0x59
- Fixed in 27.2 (NTL setter now bounds)
github.com/MchinaMd57764/AVE…
credit: Calif / Chollima (find), @MchinaMd57764 (repro)
#iOS #kernel #CVE
IOSGod retweeted
I’m continuing my research into the SPTM bypass, focusing on assessing its feasibility and potential implementation.
