Europe firm reveals unpatchable iPhone BootROM exploit

•4mo ago

Europe firm reveals unpatchable iPhone BootROM exploit

Tap title to read story

0:00 / 1:42

Brussels, Belgium – European cybersecurity firm Paradigm Shift has publicly detailed a new hardware-level BootROM exploit, dubbed "Usbliter8," that compromises the SecureROM component in millions of Apple devices built on A12 and A13 Bionic chips. The flaw affects widely used products such as the iPhone XS, iPhone XR, the iPhone 11 series, and the Apple Watch Series 4 and Series 5, all released between 2018 and 2019 and still in active use. Usbliter8 targets Apple’s SecureROM, the immutable code that runs first during device startup and anchors the company’s secure boot chain, meaning the underlying vulnerability cannot be corrected through standard iOS or watchOS software updates because the affected code is permanently embedded in the system-on-chip hardware.

Paradigm Shift’s technical disclosure explains that the exploit chains a bug in the device’s USB controller with a specific firmware configuration weakness to gain low-level control. To execute the attack, an operator must have physical access to the device and connect a specialized hardware interface, such as a Raspberry Pi Pico 2 or similar microcontroller board, to the Lightning or USB-C port. The interface sends carefully crafted USB setup packets that trigger an out-of-bounds write in memory, allowing the attacker to overwrite critical data in the processor’s registers. This sequence gives the attacker a reliable path to undermine the secure boot process on vulnerable hardware, while remaining dependent on direct, hands-on access to each targeted device.

Published 2026-06-22 11:20:48 UTC · Published by JQJO

Published by JQJO Editorial Desk · AI assisted

More context

Timeline

2018 Apple releases A12-based iPhone models
2019 Apple releases A13-based iPhone series
2018–2019 Apple Watch Series 4, 5 launch
Recently Paradigm Shift analyzes SecureROM behavior
Recently Researchers identify chained USB vulnerabilities
Recently Usbliter8 exploit technical details documented
Today Firm publicly discloses Usbliter8 BootROM exploit
Today Millions of affected Apple devices remain vulnerable

Why it matters

If you own an iPhone XS, XR, 11, or Apple Watch Series 4 or 5, your device could be vulnerable. The exploit requires physical access to your device, so keep it secure. Check for updates from Apple regularly.

JQJO Editorial Desk · Human reviewed · AI assisted. Report a correction.

Editorial policy and corrections · Our team

Cyber‑security firm Wiz Research announced on Wednesday that it had discovered severe security flaws in PHP, a programming language that powers about 70 percent of the world’s websites. OpenAI called the bug “one of the most impactful vulnerabilities in recent memory.” The flaws could allow attackers to take control of servers, steal data, and deface sites. Governments from the U.K. to Japan are rushing to patch affected sites. The U.S. National Security Agency warned organizations to maintain heightened awareness, while the U.K.’s National Cyber Security Centre urged immediate updates. Dozens of British, Finnish, French and Chinese government services were taken offline, and Japan’s Prime Minister Sanae Takaichi issued an urgent call for action. Cloudflare’s Matthew Prince reported tens of thousands of exploitation attempts in the first 45 minutes after the disclosure.

Anthropic deputy security chief Jason Clinton warned of a "vulnerability tsunami" that could expose critical infrastructure. He urged companies to patch core network vulnerabilities before exploitation. Andrew Curran highlighted active threats to energy, food, and water infrastructure, noting probing activity. He also reported a hack of Quest Diagnostics, which serves roughly half of U.S. hospitals. Matt Shumer warned of large‑scale disruptions from AI, describing a scenario where personal data leaks and service outages could occur. Shumer advised updating software, avoiding unfamiliar sites, and unplugging unused smart devices to protect accounts.

China’s Communist Party will convene a closed‑door plenum from Monday to Thursday, gathering about three hundred senior members to discuss tightening discipline. The session, the fifth since the current Central Committee was formed in 2022, is seen as a chance for President Xi Jinping to reinforce his authority and sustain the anti‑corruption campaign he launched in 2014. Analysts expect the meeting to signal system‑wide changes rather than personnel moves, as Xi’s purges have already investigated millions of officials and cleared hundreds of senior leaders. The plenum is likely the last major gathering before the 2027 leadership reshuffle, when many of Xi’s close associates are expected to retire.