Researchers hack iPhone in security demo
Archived — this story has rotated out of today’s deck. It is kept here in full.
The gist
A security research team announced it hacked the iPhone, with demos shown at Hexacon in Paris.
No technical write-up is out yet, so the claim is drawing scrutiny over methodology.
Background
Calif, the publisher of a blog post titled "Today, we hacked what we'd set out to hack: the iPhone," announced the work along with demos revealed at Hexacon in Paris, including a Signal one-click demo and an iMessage demo. The post says everything will be released in due time, but no technical details or write-up have appeared yet. Cosmic Rundown, a newsletter covering the story, framed it around how Apple's bug bounty program, researchers' goals and responsible disclosure rarely align perfectly, and noted the team documented its approach from objective to execution.
How it unfolded
- Oct 16, 2026Comments on the Calif blog post ask for more details and when the write-up is due.
- Oct 23, 2026Cosmic Rundown reports the team published the iPhone hack announcement and that the Hacker News discussion is picking apart the methodology.
- Oct 23, 2026A daily.dev post says demos were revealed at Hexacon in Paris, including a Signal one-click demo and an iMessage demo, with everything to be released in due time.
- Oct 23, 2026The Calif post is submitted to Hacker News by pavel_lishin, drawing 9 points.
Who’s saying what
- Official
- Calif says the team hacked what it set out to hack, that demos were revealed at Hexacon in Paris, and that everything will be released in due time.
- Analysts
- Cosmic Rundown writes that Apple's bug bounty program, researchers' goals and responsible disclosure rarely align perfectly, and notes the team documented its approach from objective to execution.
- Public
- On daily.dev the 195-comment discussion barely engages with the hack itself, sprawling into iOS lockdown versus jailbreaking and monopoly power, with 55% of the take skeptical.
Still unverified
No technical details or write-up have been released; the blog says everything will be released in due time, and the Hacker News discussion is picking apart the methodology.