Cellebrite unveiled zero-day LOKI, a boot ROM exploit for Apple chips from iPod touch 2 to ...

X • October 17, 2026

International Cyber Digest @IntCyberDigest ‼️BREAKING: Cellebrite unveiled zero-day LOKI, a boot ROM exploit for Apple chips from iPod touch 2 to iPhone 11. Its Hexacon slide calls it a timing race that some early proofs of concept won just 1 in 25 times. Boot ROM code is burned into the chip. No update can fix it. 11:29 AM · Oct 17, 2026 · 68.6K Views 33

International Cyber Digest @IntCyberDigest 6h Source: Angelos T. Kalaitzidis @0xShad3 8h Hell yeah Cellebrite is dropping SecureROM 0days on stage (variant of usbliter8) !!

uwatma8 @uwatma8 6h An Israeli company, im not surprised, all these exploits coming after Apple started designing its new chips in Israel is no coincidence. Did Apple really think sharing its internal diagrams with companies in the spyware capital country of the world wouldn’t backfire? 7

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Cellebrite Reveals LOKI: Zero-Day Boot ROM Exploit for Apple Devices Cellebrite has unveiled a zero-day exploit named LOKI at the Hexacon conference, targeting the boot ROM of Apple chips from the iPod touch 2 to the iPhone 11. This exploit, which requires physical access to the device via USB in DFU mode, takes advantage of a timing race condition, with early proof-of-concept builds achieving a success rate of only 1 in 25 attempts. The boot ROM is immutable and cannot be patched through software updates, making this a significant vulnerability. The exploit leverages a DMA bug in the Synopsys DesignWare USB controller, potentially affecting a decade's worth of Apple SoCs from A5 to A13. The session was presented by Steven De Franco, a known researcher from Cellebrite. The implications of this exploit are serious for users of older Apple devices, as it allows for data extraction before any operating system defenses are activated. 2 sources 68

Extracted Entities

Cellebrite unveiled zero-day LOKI, a boot ROM exploit for Apple chips from iPod touch 2 to ...

The full story

Extracted Entities

Attack Types (1)

Companies (1)

Platforms (2)

Tools (1)