Pinned Tweet
¡BIENVENIDO/A! ❤️
Deslízate hacia abajo y encontrarás todos los lanzamientos más recientes de tweaks, repositorios, desarrolladores, noticias, compatibilidad, y mucho más.
#TweaksNews
New macOS 27.0.1 PoC: AGX firmware R/W via PAC callback + pointer reuse, protected GFX PTE control. Built on @alfiecg_dev's KextRW.
macOS only: M4 Pro/Max, base M5 & MacBook Neo. Also works on iOS (DarkSword); PoC coming.
SPTM bypass pls, @calif_io? 😅
github.com/0xjohnnydev/AGX-R…
TweaksNews retweeted
Henge 0.1 is out, and with it allows you to run macOS on iOS/iPadOS!
This has been a project of mine for about 2 weeks, and I’m very happy to finally release it! It’s in a good state, and ready to release.
Download: github.com/Leviidev/Henge/re…
TweaksNews retweeted
I’m found CPU OOB wrote exploit on IOS 27.2 RC😍 (tested on 17 Pro with 26.6.1 RC and base iPhone 14 with 27.2 RC)
TweaksNews retweeted
I wanna highlight that yes.. clearly ofc.. we got jailbreaks going on rn, but I think about the future.. not about some frozen time.. Switzach can work for the next years probably for the next versions. 27.x, 28.x maybe even 29.x and that is why it is so hard in development!
TweaksNews retweeted
Read-Only Sandbox Escape on iOS 27.0 Beta 3 🧵
@forcequitOS
Used known `bad_query` vector to read systemgroup `configurationprofiles` (CloudConfigurationDetails.plist) from an App Store app.
Write blocked (EPERM). A13. PoC soon on GitHub 👀
Video proof ↓
CVE-2026-112688 – Apple CoreMedia memory corruption (iOS/iPadOS <26.7/27.2, macOS)
Sandboxed app → crafted Dolby Vision RPU → launchd-owned backboardd
Malformed Level-8 record count (forces 42 Level-10) → CoreMedia writes past stack array
Overwrites QuartzCore saved LR with 0x4141414141414141
PAC rejects → EXC_ARM_PAC_FAIL, PC stays at QuartzCore retabsppc (+0x2026c4)
Same primitive replaces low 32 bits of pointer used by strb 1, [x8]
→ constrained write-1 (e.g. 0x1f9c49088 reads back 1), process survives
PoC + evidence: github.com/0xjohnnydev/CVE-2…
Credits: @0xjohnny (building on Ping-2o/duper-cves + quietvoid/dovi_tool)
#iOS #Apple #CoreMedia #PAC #backboardd
TweaksNews retweeted
🔬 Just published my iOS security research repo.
Static RE notes, patch-diffs & trust-boundary analysis on modern iOS:
• SPTM / TXM monitors• Secure Kernel exclaves
• Kernel zone mitigations
• Media parsers (ImageIO etc.)
No exploits.
Just the map of how Apple hardens things.
Feedback from RE / kernel researchers welcome.
github.com/AzozzALFiras/iOS-…
#iOSSecurity #AppleSecurity #ReverseEngineering #iOS #SecurityResearch
TweaksNews retweeted
Also saw everyone is losing their minds over the iOS kernel r/w. I’m home now and aiming to release the exploit + writeup within the next week or so. Thank you for your attention to this matter (and all the “wen eta”s) 🙏
iOS 27.0.1 kernel panic from one VideoToolbox value.
CVE-2026-112705, AppleAVE2 OOB write. Set NumberOfTemporalLayers to 16463 and the first encode panics videocodecd. 16462 survives. Fixed in 27.2.
DoS only, no R/W primitive. Clean repro on iPhone 17 Pro.
github.com/MchinaMd57764/AVE…
credit: Calif / Chollima team (find), MchinaMd57764 (repro)
TweaksNews retweeted
Working on a jailbreak for iOS 27.0-27.0.1
Currently have: CASLR bypass , Stable kernel read/write
Working on sandbox patch and the rest.
Open to questions, but no PoC for now.
Prefer dropping a clean jailbreak over raw primitives
@Lakr233 @onejailbreak_ @0xjohnny @Little_34306
TweaksNews retweeted
Back to ROOT! iOS 27.0.1 #MobileSecurity #jailbreak
































