Leaked Cellebrite flyer claims short-range access to locked iPhones 11 to 16; a researcher suspects iOS 26.5 blocks it

What happened

On October 17, 2026, an independent researcher who publishes at justin.sh described a Cellebrite document marked confidential. It advertises Advanced Unlocks, a "breakthrough method" for getting into locked iPhone 11 through iPhone 16 models running iOS 26 through "26.4+", provided the phone is in the After First Unlock (AFU) state: switched on and unlocked at least once since its last restart. According to the document, the method works with Apple's Stolen Device Protection turned on and relies on a dedicated appliance with a stated range of about 8 metres. The document dates from March 2026 and was last revised on September 15. The researcher published an image of the flyer and withholds the original file to protect a source.

Cellebrite has not confirmed the document, but its own investor communications confirm the product. A Cellebrite press release of August 13, 2026 lists Advanced Unlocks among the new offerings introduced since the start of the year that customers are adopting. Neither Cellebrite nor Apple had commented publicly on the leak as of October 20, according to Cyber Kendra, and we found no statement from either company as of October 22.

The rest of the story is the researcher's analysis, which the researcher labels speculation. The flyer's highest claimed iOS version stopped advancing in the spring: 26.3+ in March, 26.4.2 in May, and 26.4+ in September, by which time iOS 26.7 and iOS 27 had shipped. Comparing the Bluetooth daemon in iOS 26.4 and iOS 26.5, the researcher reports finding a small cluster of security fixes in low-level Bluetooth connection handling, including what they describe as a use-after-free that nearby devices could reach without pairing. The researcher calls it "a strong candidate" for the flaw behind Advanced Unlocks and says no proof of concept was built. Apple's iOS 26.5 security notes list no Bluetooth CVE.

Timeline

1. September 9, 2025Apple announces Memory Integrity Enforcement (MIE), built into all iPhone 17 models and iPhone Air (Apple Security Research).
2. March 18, 2026Earliest flyer revision the researcher lists; it claims support up to iOS 26.3+ (justin.sh).
3. May 11, 2026iOS 26.5 released. Its security notes list no Bluetooth CVE (Apple).
4. May 20, 2026Flyer revision claims iOS 26.4.2, one release behind the current version (justin.sh).
5. August 13, 2026Cellebrite names Advanced Unlocks among its new 2026 offerings (Cellebrite).
6. August 25, 2026Apple adds an acknowledgment for "CoreBluetooth - LE", without a CVE, to the iOS 26.5 notes (Apple).
7. September 14, 2026iOS 26.7 and iOS 27 fix CVE-2026-65414, a Bluetooth flaw that Apple says may let a remote attacker execute arbitrary code (Apple).
8. September 15, 2026Latest flyer revision still claims "26.4+" (justin.sh).
9. September 28, 2026iOS 26.7.1 fixes CVE-2026-86950 in CoreGraphics, which Apple says may have been exploited against specific targeted individuals. CISA adds it to KEV on September 29 (Apple, CISA).
10. October 17, 2026The researcher publishes the flyer and the analysis (justin.sh).
11. October 19, 2026Apple adds entries to its iOS 26.7 and iOS 27 notes, including two Bluetooth issues credited to outside researchers. Neither refers to iOS 26.5 or to forensic tools (Apple).

What is confirmed and what is not

• Confirmed: Cellebrite sells a product called Advanced Unlocks, introduced in 2026 (Cellebrite).
• Confirmed: iOS 26.5 shipped on May 11, 2026 with no Bluetooth CVE in its security notes. iOS 26.7 and iOS 27 then fixed Bluetooth flaws that Apple describes as possible remote code execution (CVE-2026-65414) and as a crash an attacker in radio range could trigger (CVE-2026-84613) (Apple).
• Claimed by the flyer, not verified: AFU access to iPhone 11 to 16 on iOS 26 through "26.4+", a range of about 8 metres, and that it works with Stolen Device Protection on. The flyer does not say whether iPhone SE or "e" models are included (justin.sh).
• The researcher's theory, not confirmed: the method relies on a Bluetooth flaw that iOS 26.5 fixed. The "+" in "26.4+" may mean newer versions work too. No official source says which iOS version, if any, stops the tool.
• Not in the flyer: iPhone 17 models and iPhone Air, which have MIE, Apple's hardware memory tagging. The researcher thinks MIE explains the gap; Cellebrite has not said.
• Not listed anywhere official: as of October 22, 2026, no CVE, Apple advisory or CISA KEV entry ties a vulnerability to Advanced Unlocks. None of the Bluetooth CVEs above is in KEV (CISA).

Who is at risk

Advanced Unlocks is a forensic product, not malware. Cellebrite describes itself as a supplier of digital investigative and intelligence solutions for the public and private sectors. The exposure is a phone that ends up with an agency or contractor that buys Cellebrite services: police custody, a border inspection, a search, a seizure in litigation. Journalists, lawyers, executives who travel to high-risk jurisdictions, and staff who handle confidential sources or client files fit that profile. Such tools have been misused before: in December 2024 Amnesty International documented Serbian police and intelligence officers using Cellebrite products to unlock the Android phones of a journalist and activists during police interviews and install spyware on them.

The phone's state matters as much as its software version. The flyer claims AFU access only. A phone that has been powered off, or restarted and not unlocked since, is in the Before First Unlock (BFU) state, in which the encryption keys that are held in memory after the first unlock are gone (justin.sh). Most phones spend almost all their time in AFU, because their owners unlock them every day.

The 8-metre figure does not, on the public evidence, mean that someone can copy data from a phone in your pocket. In the researcher's reading, the radio step opens the device and the data is then copied over a cable, which needs the phone in hand. That is a theory; the flyer does not explain the method. For a phone lost to an ordinary thief this leak changes little, since nothing public suggests the tool is available outside Cellebrite's customer base. Stolen Device Protection, a strong passcode and a quick remote lock remain the controls for that case.

What updating changes, and what it does not

Updating is the cheapest step and closes holes Apple has confirmed. No official source says it stops this tool.

• iOS 26.5 or later contains the Bluetooth changes that the researcher believes may have broken Advanced Unlocks (unconfirmed). That link is unconfirmed, but it is the version the available evidence points to.
• iOS 26.7.1 or iOS 27.0.1, current as of October 22, 2026, include the fix for CVE-2026-65414, a Bluetooth flaw that Apple says may allow a remote attacker to execute arbitrary code (Apple).
• iOS 26.7.1 also fixes CVE-2026-86950, a CoreGraphics flaw that Apple says may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions before iOS 27. CISA lists it as known exploited (Apple, CISA).
• Every iPhone from the iPhone 11 on can run iOS 27. The iPad Pro 12.9-inch (3rd generation), iPad Pro 11-inch (1st generation), iPad Air (3rd generation), iPad (8th generation) and iPad mini (5th generation) cannot run iPadOS 27 and should be on iPadOS 26.7.1 (Apple).
• Updating does not protect a phone that has already been seized. If "26.4+" means the method still works on newer releases, updating alone does not stop it.
• Updating does not add MIE to an iPhone 11 to 16. MIE is part of the hardware and software of the iPhone 17 models and iPhone Air only (Apple Security Research).

What to check in MDM and on the device

• Inventory by model and build. Report every managed iPhone and iPad with its exact OS version. Treat anything below 26.5 as urgent and anything below 26.7.1 or 27.0.1 as out of compliance.
• Enforce the update with a deadline. On iOS 17 and later, the declarative Software Update configuration sets a target OS version and a local date and time after which the device installs the update by itself (Apple Platform Deployment).
• Prioritise hardware for high-risk staff. Issue iPhone 17-family devices or iPhone Air to people likely to face seizure: they have MIE and are absent from the flyer (Apple Security Research, justin.sh).
• Restrict USB pairing on supervised devices. Leave "Allow connected accessories while locked" off so USB Restricted Mode stays in force, and turn off "Allow pairing with non-Apple Configurator hosts" so only computers holding your supervision identity can pair (Apple Platform Deployment). Pairing records on a user's own computer can help an examiner copy data from a phone in AFU (Elcomsoft). The flyer claims Advanced Unlocks works with Stolen Device Protection on, which already tightens computer pairing (Elcomsoft), so treat these settings as baseline hygiene, not a fix.
• Make Stolen Device Protection part of onboarding, and for high-risk users set Require Security Delay to Always. It needs two-factor authentication, a passcode, Face ID or Touch ID, Significant Locations and Find My (Apple). It protects against a thief who knows the passcode; the flyer claims Advanced Unlocks works with it on.
• Require a long passcode through your MDM passcode policy, alphanumeric for high-risk users. The passcode is what protects a phone in BFU.
• Offer Lockdown Mode to the few who need it. Apple designs it for people who may be personally targeted by sophisticated threats. With it on, a locked iPhone does not connect to accessories or computers. Administrators cannot turn it on through MDM; a device enrolled before Lockdown Mode is enabled stays managed, but a device in Lockdown Mode cannot be newly enrolled (Apple). The flyer does not mention Lockdown Mode, so its effect on this tool is unknown.
• Explain how Bluetooth really turns off. The Control Center button only disconnects accessories; Apple Watch, Apple Pencil, Instant Hotspot and Continuity features stay connected. Turning Bluetooth off in Settings disables it completely (Apple). If the researcher's theory is right, a phone with Bluetooth fully off is harder to reach. That is unconfirmed, but it costs nothing where a seizure is possible.

If a device is seized or lost

• Power off before risk. Ask staff to switch phones off before border crossings, protests and any situation where detention is plausible. A phone that is off, or restarted and not yet unlocked, is in BFU and outside what the flyer claims (justin.sh). Since iOS 18.1, iOS also restarts a phone that stays locked for 72 hours, which limits how long a seized phone stays in AFU (Magnet Forensics, 2024).
• Record the facts: time, model, exact iOS build, and whether the phone was on and had been unlocked since its last restart. A powered-on iPhone 11 to 16 below iOS 26.5 is the case the flyer describes.
• Revoke access, not just the device. Rotate the passwords and tokens the phone held: mail, single sign-on sessions, VPN and Wi-Fi certificates, messaging-app sessions. Revoke the certificates your MDM issued to it.
• Agree with counsel in advance when to lock or erase remotely. For a lost phone, Lost Mode or a remote erase is routine. For a phone held by authorities, remote action can carry legal risk, so set the policy before it is needed.
• Treat a returned device as untrusted. In the Serbian cases, Amnesty International reported finding spyware installed on phones while police held them. Preserve what legal needs, then erase and re-provision the device.

Why the hardware generation now matters

If the researcher is right, Apple fixed the flaw in May without listing it, and a tool marketed as "more resilient to Apple's OS changes" stalled at the next release. Silent fixes protect only the devices that install them, so the update deadline is the control that matters. The model cutoff is the second signal: the flyer has left out the iPhone 17 generation through three revisions, and the researcher attributes the gap to MIE rather than to a backlog, though Cellebrite has not said. For organisations whose staff may have phones taken from them, hardware generation is now a security control. Budget the refresh for those staff first, and keep everyone else on the current release.

Sources

1. justin.sh: Is Cellebrite sitting on an iPhone radio 0day? (October 17, 2026)
2. Cellebrite (PR Newswire): Cellebrite Appoints Shiven Ramji Chief Executive Officer, Succeeding Thomas E. Hogan (August 13, 2026)
3. Apple: About the security content of iOS 26.5 and iPadOS 26.5
4. Apple: About the security content of iOS 26.7 and iPadOS 26.7
5. Apple: About the security content of iOS 26.7.1 and iPadOS 26.7.1
6. Apple: About the security content of iOS 27 and iPadOS 27
7. Apple security releases
8. CISA Known Exploited Vulnerabilities catalog: CVE-2026-86950
9. Apple Security Research: Memory Integrity Enforcement (September 9, 2025)
10. Apple: About Stolen Device Protection for iPhone
11. Apple: About Lockdown Mode
12. Apple: Use Bluetooth and Wi-Fi in Control Center
13. Apple Platform Deployment: Software Update declarative configuration
14. Apple Platform Deployment: Device management restrictions for supervised Apple devices
15. Apple Platform Deployment: Manage accessory access to Apple devices
16. Elcomsoft: Forensic Implications of Apple Stolen Device Protection (June 1, 2026)
17. Magnet Forensics: Understanding the security impacts of iOS 18's inactivity reboot (November 13, 2024)
18. Amnesty International: Serbia: Authorities using spyware and Cellebrite forensic extraction tools to hack journalists and activists (December 16, 2024)
19. Cyber Kendra: Cellebrite Advanced Unlocks Leak: Wireless iPhone Unlock (October 20, 2026)