The Cellebrite iPhone leak is about seized phones, not remote hacking

By Wednesday morning a claim was doing the rounds that "iPhone 11 through 16 are apparently vulnerable to remote attacks". It came without a source, and the word "apparently" was doing heroic work. Followed back to its origin, it leads to a sales flyer rather than an Apple advisory or a researcher's proof of concept.

That flyer is worth reading carefully, because what it describes is both less alarming than the rumour and more relevant to some readers than they might like.

What the flyer says

The document surfaced on a personal blog, whose author says it was sent to them as a leaked, confidential Cellebrite brochure, and was picked up by Privacy Guides on 19 October. It describes a feature called "Advanced Unlocks": a single dedicated appliance, with a stated range of about eight metres, that unlocks iPhones in the "after first unlock" state. It pitches this as a hedge against labs being "shut out" by future iOS updates, says it "separates access from extraction", and says it is available only on a limited basis.

According to Cyber Kendra's write-up, the supported list runs from iPhone 11 to iPhone 16, works even with Stolen Device Protection enabled, and is described as "a few months old". The flyer doesn't say how the appliance talks to the phone. An eight-metre range implies a radio, and "separates access from extraction" suggests something other than the USB port Cellebrite's tools have traditionally used.

What it doesn't say

Nothing in the flyer suggests an attacker can reach your phone over the internet, or that anyone without the appliance can do anything at all. Cellebrite sells to police forces, border agencies and other governments. This is a forensic product for a phone that is already in an investigator's hands, or at least within a few metres of them.

It isn't confirmed either: neither Cellebrite nor Apple has commented, and the document hasn't been authenticated. What is on the record is that Cellebrite has been selling something called Advanced Unlocks this year: its August earnings release said customers were adopting it. The product exists; the specific capabilities in the flyer are unverified.

The blogger suspects a Bluetooth flaw that Apple fixed quietly. iOS 26.7, released on 14 September, did fix three Bluetooth bugs, including an out-of-bounds write that Apple says could let "a remote attacker" execute code. Apple didn't mark any of them as exploited, and nothing public links them to Cellebrite, so for now it remains a theory.

The device list is interesting for what it leaves out, since it stops at iPhone 16. The iPhone 17 range introduced Memory Integrity Enforcement, Apple's hardware memory tagging, which is designed to make exactly the kind of memory-corruption exploit chain a radio attack would need much harder. That omission is consistent with MIE working as intended, though the flyer's age could explain it equally well.

Why "after first unlock" is the phrase that matters

An iPhone has two broad states. Before you enter your passcode for the first time after a restart, it is "before first unlock" (BFU): most of your data is still encrypted with keys derived from that passcode, and very little is available to anyone. Once you have unlocked it once, it is "after first unlock" (AFU), and a great deal more key material sits in memory so that the phone can work normally while locked.

Forensic tools have always found AFU phones far easier, and this flyer is explicitly about AFU. A phone that has been switched off and on again, and not unlocked since, is a much harder target.

Apple has leaned into this. Since iOS 18.1, an iPhone that hasn't been unlocked for 72 hours restarts itself, returning to BFU. That helps if a phone sits in an evidence locker, but it does nothing for the first three days.

The verdict

This is not a reason for most iPhone owners to panic, and the "remote attack" framing is wrong. It is a credible indication that at least one forensic vendor believes it can get into locked, recently used iPhones up to the 16 without plugging anything in. If you are a journalist, an activist, someone who crosses borders with sensitive material, or anyone whose phone could plausibly be seized, that is the threat model the flyer describes, and you should act as though it is accurate until someone shows it isn't.

What to do

1. Update to iOS 26.7 or later, or iOS 27. If the Bluetooth theory is right, that closes the door; if it isn't, you have lost nothing.
2. Restart before the moment of risk. Before a border crossing, a protest or any situation where your phone might be taken, power it off, or restart it and don't unlock it. That puts it back in BFU.
3. Turn Bluetooth off properly. The Control Centre toggle only disconnects accessories; switch it off in Settings if you want the radio off.
4. Use a long alphanumeric passcode, which is what protects a BFU phone, and a six-digit PIN is a much weaker key.
5. Consider Lockdown Mode if you are at genuine risk of targeted surveillance. It won't necessarily stop this tool, but it shrinks the attack surface for everything else.
6. Don't rely on Stolen Device Protection here. It is a defence against thieves, and the flyer claims it is no obstacle.

If you aren't in any of the groups above, install the update and file this under interesting rather than urgent.