ByteVortex

iOS Researcher and App Developer

[𝗬𝗮𝗻𝗴𝗝𝗶𝗶𝗶 @duongduong0908]

- Change the passcode interface using AirLift
- Works on iOS versions up to 27 Final (24A437)

[johnny @0xjohnny]

To celebrate iOS 27’s release, why not release a sandbox escape?

Announcing airlift: a PoC abusing a media sync path for out-of-scope access across much of /var/mobile via macOS↔iOS pairing.

No MobileGestalt edits yet; looking into it.

https://t.co/NXpVzwvgfH

[ByteVortex @ByteV0rtex]

@ncxcq Bro you were really fighting me over “AI slop”and saying my stuff was AI generated while yours was “written with hands”… then you drop a repo that opens with “Claude code was used for documenting markdown.” Make it make sense.

[ByteVortex @ByteV0rtex]

@forcequitOS Wow they still didn’t patch it? That’s wild

[ByteVortex @ByteV0rtex]

@AboGhzayel Yeah np, but I wouldn’t call it “Massive”😁

[ByteVortex @ByteV0rtex]

@AboGhzayel Yeah it won't work because the KASLR slide, stale_id, IOGPUDevice resource table offset, IOGPUSysMemory field offsets, getattrlist packed size, OOB slot offset, vfs_attr_pack_internal VA etc. are all hardcoded for ip 12. You need to analyze the kernelcache for your device model.

[ByteVortex @ByteV0rtex]

@AboGhzayel The reason it won't work standalone is because it needs the https://t.co/J21w7aeqji.private.AppleKeyStore entitlement which a sideloaded app doesn't have or the fishhook to intercept SecKeyCreateRandomKey which is blocked on 26 because __DATA_CONST is read-only.

[ByteVortex @ByteV0rtex]

@AboGhzayel You modified the code for your chip right? Cause the code on github is for A14. Also you might need different entitlements depending on setup.

[ByteVortex @ByteV0rtex]

Published PoC repos for 4 iOS 26.6 kernel CVEs I researched: IOGPUFamily UAF, AppleKeyStore OOB read(KASLR Defeat), setxattr PAC bypass, getattrlist OOB write.

Details and source at: https://t.co/nloO9Mc78l & https://t.co/uUTsIZmZHo

[ONE Jailbreak @onejailbreak_]

📣CVE-2026-65343 PoC — AppleKeyStore OOB read → KASLR defeat (iOS 26.6 / 23G71) by @ByteV0rtex

https://t.co/eCInGlTMRx

[ByteVortex @ByteV0rtex]

@ncxcq @namenombrenom @skadz108 @charaleez_mc Cool. My PoCs are on my github, public, with working code. Where's the jailbreak you promised two weeks ago?

[ByteVortex @ByteV0rtex]

@nishithX26 Framework

[ByteVortex @ByteV0rtex]

@namenombrenom @skadz108 @charaleez_mc yeah ik it was obvious from the start

[ByteVortex @ByteV0rtex]

@skadz108 @charaleez_mc Yo skadz did apex actually send you any proof or was it all cap

[ByteVortex @ByteV0rtex]

@ncxcq @rooootdev Was hoping for ios 27 support

[ByteVortex @ByteV0rtex]

@agnu0812 @rooootdev No, the exploit was patched in beta 5

[ByteVortex @ByteV0rtex]

@JasonPeng14214 @0xjohnny You need an enterprise certificate if you’re lucky you can find one for free but they are sold for a couple of bucks too.

[ByteVortex @ByteV0rtex]

@sdw4938 @0xjohnny U need to use enterprise certificates

[Artem Novichkov @iosartem]

“we sandboxed the agent”

meanwhile the agent: