This Persistent iPhone Jailbreak Survives Lockdown Mode and iOS 27.2

A team of white-hat hackers has developed a new jailbreak for the iPhone, and this one is a big deal as it persists even with Lockdown Mode enabled — and even after the device is updated to iOS 27.2.

What Is Lockdown Mode?

Lockdown Mode was developed by Apple as a way to harden the iPhone’s security, intended to protect high-profile users — such as journalists, politicians, and activists — from targeted cyberattacks by blocking many of the main avenues of attack.

Lockdown Mode offers the following protections:

1. Messages: Most message attachment types are blocked, other than certain images, video, and audio. Some features, such as links and link previews, are unavailable.
2. Web browsing: Certain complex web technologies, like just-in-time (JIT) JavaScript compilation, are disabled unless the user excludes a trusted site from Lockdown Mode.
3. Incoming FaceTime calls are blocked unless you have previously called that person or contact within the past 30 days. Features such as SharePlay and Live Photos are unavailable.
4. Apple services: Incoming invitations and service requests are blocked in apps like Home. Game Center is also disabled.
5. Wired connections with a computer or accessory are blocked when iPhone is locked.
6. Wireless connectivity: Your device won’t automatically join non-secure Wi-Fi networks, and will disconnect from a non-secure Wi-Fi network when you turn on Lockdown Mode. 2G and 3G cellular support is turned off for iPhone and iPad.
7. Configuration profiles cannot be installed, and the device cannot enroll into mobile device management (MDM), while Lockdown Mode is turned on.

Earlier this year, Apple stated, “We are not aware of any successful mercenary spyware attacks against a Lockdown Mode-enabled Apple device.” In other words, Apple was claiming a 100% protection rate since 2022. However, today’s news could potentially lower that success rate by a few percentage points.

How Does the Jailbreak Work?

Hacker group Calif has posted a video to X showing an iPhone 18 Pro with Lockdown Mode enabled. In the video, we see a PDF being sent to the iPhone via AirDrop, which is then viewed on the device.

While Calif hasn’t shared any technical details on how the jailbreak works, the video’s soundtrack hints that the PDF itself carries the exploit code. As the file opens, the music shifts from a lighthearted tune to something more sinister, and a dancing character and the Calif logo begin bouncing around the screen — presumably to show that the iPhone is now jailbroken.

That said, the jailbreak could have been performed before the video was recorded.

Immediately after the PDF is received via AirDrop and opened, the video shows the user navigating to the Software Update section of Settings, which displays a pop-up warning that Lockdown Mode is enabled and that certain settings will be affected.

The user then dismisses the notification, opts to install the iOS 27.2 update — which was released to the public last week — enters the iPhone’s passcode, and allows the update to download and install.

The iPhone takes a few minutes to process the update and reboots after it completes successfully. Once the user enters their passcode, we find that the jailbreak is still in place, even after it is running the latest available version of iOS.

Calif told MacRumors that it would be disclosing the discovered vulnerabilities to Apple, and would not be releasing a jailbreak tool into the wild.

As pointed out by Mactrast, modern AI tools make it child’s play to fake videos like these. There are also plenty of unanswered questions here, such as when the jailbreak actually occurs in this process, and whether iOS 27.2 is actually vulnerable, since the exploit is demonstrated on an older version of iOS, presumably some flavor of iOS 27.0, since the video shows an iPhone 18 Pro.

Nevertheless, if the video is genuine, it shows that Apple’s Lockdown Mode, while a secure way to protect your iPhone and your data from attacks, is not infallible.

While it appears Apple certainly has more work to do to prevent jailbreaks like this one, Calif’s disclosure of the vulnerabilities and how they were exploited will allow Apple to once again harden its devices against attacks like these. Well, at least until the next attack.