A leaked Cellebrite flyer describes a new product called Advanced Unlocks (AU) that claims forensic AFU access to iPhone models 11-16 running iOS 26-26.4+, works even with Stolen Device Protection enabled, and is delivered via a dedicated appliance with an effective range of roughly eight meters. The flyer’s model and iOS range conspicuously omit the iPhone 17 line and trails Apple’s shipping iOS releases, which suggests a capability that was broken by subsequent updates. The write-up argues AU is a proximity radio technique rather than a USB or NFC method and points to Cellebrite marketing and revision timing as evidence that AU was intended to be resilient to OS changes but was undermined by patches and by hardware defenses in newer models.
Technical analysis compares bluetoothd from iOS 26.4 and 26.5 and identifies hardened L2CAP changes in 26.5 that fix a use-after-free in the pre-pairing aggregated-packet receive loop. The proposed AU chain is: crafted over-the-air L2CAP signaling packets processed before pairing trigger a UAF in bluetoothd, attacker-controlled code in the daemon escalates to the kernel via IOKit drivers, and kernel control lifts USB restrictions to image the device. iOS 26.5 and later hardenings, plus memory integrity enforcement (MIE) and memory tagging on iPhone 17, likely blocked this vector. Apple patched the issue with limited public disclosure, and the analysis concludes that Apple’s layered hardening is forcing forensic vendors away from traditional charging-port attacks.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
A PHP vulnerability currently has no working exploit, despite many fake PoCs circulating online. LLMs have falsely been portrayed as able to develop exploits, but practical testing shows no effective attack exists yet. (eliastaylor.com)
The Trump administration denaturalized two individuals who obtained U.S. citizenship by hiding their criminal activities. The move aims to revoke citizenship from those who gained it through fraudulent means. (justice.gov)
Meta's new enterprise terms state that if its AI makes a mistake, the customer is legally responsible. The terms also expand liability to content from partners and give Meta rights to scrape and use user content. (cio.com)
A vulnerability in HTTP/3 implementations allows remote clients to cause servers to allocate excessive memory by exploiting QPACK header compression. Seven of ten tested implementations are vulnerable, with some already patched to prevent resource exhaustion. (foxio.io)
Oracle has issued a security alert for CVE-2026-91403, affecting multiple Java and GraalVM products. Patches are available for supported versions, and Oracle recommends upgrading to ensure security. (oracle.com)
Help desks are increasingly targeted by social engineering attacks to reset MFA accounts. Effective verification methods for remote staff and contractors are being explored to prevent breaches. (news.ycombinator.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.