iPhone Lockdown Mode: What It Blocks and What Breaks

Calif showed a new iPhone jailbreak at Hexacon. How message attacks reach an iPhone, who needs Lockdown Mode, what it turns off, and the USB setting to check.

Lockdown Mode

Zero-click

One-click

Cable

Lockdown Mode Extreme protection

iPhone On October 16, at the Hexacon security conference in Paris, the Calif team jailbroke an iPhone 18 Pro running iOS 27.0.1, live on stage. Hours later it posted clips teasing a “Signal 1-click” attack and an iMessage one, with a single line: “Everything will be released in due time.”

Update: iOS 27.2, released October 26, is the update to install. Apple’s iOS 27.2 security notes credit Calif researchers on six fixes, and Calif’s Stefan Esser has said most of the bugs in the jailbreak are fixed in 27.2. Most isn’t all: Apple doesn’t say which fixes belong to the demo chain, and the Signal and iMessage attacks aren’t public yet, so we can’t confirm every piece is closed. Update today, and keep the settings below in place. It’s a good time to learn how these attacks get in, and which settings close the doors.

Checked against iOS 27.2: Apple’s iOS 27.2 security notes, support pages and Platform Security Guide, Calif’s posts and statements, Hexacon’s program, Citizen Lab and Signal. Updated October 27, 2026.

Apple screens incoming iMessage data in a sandbox called BlastDoor, so an attacker needs one bug to get in and more to break out. That’s why these attacks come as chains.

BlastDoor isolates · parses transcodes · validates

iPhone A sandbox adds a layer of defense; attack chains may need more than one bug. Zero-click needs no tap and one-click needs one. BlastDoor sits only in the iMessage path, so an attacker has to get in and then break out.

Defense 1: updates, on automatic

Settings → General → Software Update → Automatic Updates, turn on Automatically Install.

Settings → Privacy & Security → Background Security Improvements, keep Automatically Install on. These are small patches for Safari, WebKit and system libraries between full updates.

Updates fix a bug for everyone. Lockdown Mode is for the bugs nobody has fixed yet.

Apple calls it “extreme protection” for “the very few individuals who, because of who they are or what they do, might be personally targeted.” Its threat notification page says these attacks “cost millions of dollars” and target people who are “often journalists, activists, politicians, and diplomats.”

Settings → Privacy & Security → Lockdown Mode → Turn On Lockdown Mode, then Turn On & Restart and enter your passcode. Your paired Apple Watch turns on with it. iPad and Mac need it separately.

The OSINT win: strangers lose easy ways in. No FaceTime from new numbers, no surprise album invites, no location in the photos you send.

Does it stop Calif’s demos? Nobody outside Calif knows yet. In 2023, Apple’s security team confirmed to Citizen Lab that Lockdown Mode blocked BLASTPASS.

Lockdown Mode gets fixes too. iOS 27.2 closes a WebKit bug that let a website use a media format Lockdown Mode should restrict, so it works best on the latest iOS. Keep it on, and keep updating.

Phone calls, plain texts and Emergency SOS still work.

Apple warns that excluding something “reduces Lockdown Mode’s protections and may increase your security risk.”

Everyone should check this one. Settings → Privacy & Security, scroll to Security, tap Wired Accessories. On a USB-C iPhone:

Lightning iPhones only get the last two. A USB power adapter charges either way. For most people, Ask for New Accessories is the right trade. If you’d turn on Lockdown Mode, pick Always Ask.