A confidential Cellebrite document leaked to an independent security blogger describes “Advanced Unlocks,” a forensic appliance the company says can get into locked iPhone 11 through iPhone 16 models from about 8 metres away, even with Apple’s Stolen Device Protection switched on.
The flyer, published in a justin.sh blog post titled “Is Cellebrite sitting on an iPhone radio 0day?”, does not say how the appliance reaches the phone. Its stated range has led the blogger to suspect a Bluetooth vulnerability that Apple has since fixed without drawing attention to it.
Cellebrite describes Advanced Unlocks as a “next-generation AFU vector that is more resilient to Apple’s OS changes.” AFU, or after first unlock, is the state an iPhone is in once its owner has entered the passcode at least once since the last restart, which leaves encryption keys in memory.
The flyer says the capability runs from a single dedicated appliance and works even when Stolen Device Protection, which tightens USB restrictions, is enabled. According to Privacy Guides’ reading of the flyer, Cellebrite also says the method keeps access separate from data extraction, implying the way in is not the USB port its kits normally use.
The document pitches the product as a hedge against forensic labs being suddenly locked out by future iOS updates, and says labs are increasingly unable to reach evidence on the newest iPhones. Cellebrite makes it available only on a limited basis.
The supported device list stops at the iPhone 16. The iPhone 17 line and iPhone Air ship with Memory Integrity Enforcement (MIE), Apple’s hardware memory tagging built to block the memory-corruption bugs that most exploit chains depend on. The Privacy Guides forum member who first circulated the post noted on 18 October that the flyer is a few months old and does not cover the latest iOS release, which would be consistent with Apple having closed the hole.
Cellebrite has sold Advanced Unlocks since early 2026
The product itself is not secret. When Cellebrite reported its 2025 results on 11 February 2026, it listed new advanced unlock capabilities as one of its growth drivers for the year. Its 13 August 2026 earnings release, which also named Shiven Ramji as chief executive in place of Thomas E. Hogan, said customers were adopting Advanced Unlocks among the new offerings introduced since January. On the call that day, executives said the second quarter was the product’s first full quarter of availability.
None of those filings explain how Advanced Unlocks works. A May 2026 Cellebrite blog post claimed its Inseyets platform could reach the latest iPhones in both AFU and before-first-unlock states, and mentioned new AFU access methods without detail. A product sold on its resilience to iOS updates appears, on its own leaked device list, to stop at the first iPhones with hardware memory tagging.
The Bluetooth theory
An 8-metre range rules out a cable and points to a radio, with Bluetooth the likeliest candidate. On 14 September 2026, Apple’s iOS 26.7 security update fixed CVE-2026-65414, an out-of-bounds write in Bluetooth that a remote attacker could use to run arbitrary code, and CVE-2026-86919, a Core Bluetooth stack overflow exploitable from a paired device. Apple did not flag either as exploited, and no public evidence links them to Advanced Unlocks.
Security researcher Bruce Schneier reposted the findings under the headline “Possible new Cellebrite iPhone Radio Zero-Day.” On the Privacy Guides forum, the member who shared the post argued that an attack on the Bluetooth stack itself would slip past anti-forensic “kill switch” apps, which only watch for devices connecting through the operating system. The same member said there is no known Android equivalent, since stock Android phones can often already be fully extracted while locked in the AFU state.
iPhone owners worried about the capability can install iOS 26.7 or iOS 27, both released on 14 September. Bluetooth is fully disabled only in the Settings app, because the Control Center toggle merely disconnects devices. Restarting the phone also returns it to the state before the first unlock, which an AFU attack cannot exploit.
Neither Cellebrite nor Apple had commented publicly on the document as of 20 October 2026. Cellebrite has not confirmed the flyer is genuine, and it is not known whether Advanced Unlocks still works on iOS 26.7 or iOS 27.
Community Discussion
Join the conversation. Ask questions, share solutions, and help others.
Be the first to start the discussion!
