Security firm roots an iPhone from a PDF in iMessage, then posts only demo videos

Three videos, no iOS version, one promise

Calif's post is a set of demo videos shown at the Hexacon security conference in Paris. It names no affected iOS version or device, lists no CVE, and gives no method. Its only commitment is that "Everything will be released in due time."

Readers had to reconstruct the substance from the videos themselves. A commenter who walked through the videos described what they saw:

"A couple of PDF exploits from iMessage and Signal leading to code execution, and an app that roots the phone. Also, they seem to have managed to make their malware survive a reboot, which is difficult."

That last detail is what moved the thread from jailbreak nostalgia to alarm. A maintainer of the Jujutsu version control system noted that persistence normally needs a SecureROM exploit and a compromise of the Secure Enclave, and that "the last true untethered Jailbreak was iOS 9 or something."

Why it is always a PDF

Several commenters asked why a document format keeps opening iPhones. A reader who linked the ForcedEntry precedent got a blunt answer:

"PDFs are basically executables, that's why it's hard. They support running code, they support decoding images which themselves have their own custom compressors that are basically code." — a commenter who had worked out from the videos where the attack surface sits

Another reader asked the obvious follow-up, whether Lockdown Mode blocks PDFs. Nobody in the thread had a confirmed answer.

Is showing it before the patch irresponsible?

A former vulnerability researcher objected: "what value is there for demonstrating a yet-to-be-patched vulnerability?" and recalled that during Calif's earlier research for Tencent the team spent an extra week using AI to build a self-propagating zero-click worm across three live phones.

A commenter who speaks for Calif answered in the same thread:

"We disclosed most of the bugs used in these chains to Apple, and are going to disclose the rest, if not already." — a Calif researcher replying in the thread

A YC S09 alumnus who worked at Dropbox took the opposite side of the original complaint: the post reveals almost nothing beyond a PDF starting point, "attracting attention like this will help encourage people to update," and they planned to install the next iOS security update immediately.

What you can actually do today

Nothing patched is named yet, so the only actionable advice is the unglamorous kind: keep iOS current and treat unexpected PDFs in messaging apps as hostile. The missing piece is the one the post withholds, the exact build range, and until Calif or Apple publishes it nobody can say whether their phone is exposed.