Hexacon 2026: what Paris showed about the phone in your pocket

One conference, one track

Hexacon is an offensive-security conference. In 2026 it ran on Friday 16 and Saturday 17 October, with a single track of 16 talks and about 20 speakers, according to the organizer [S1][S2]. Training courses ran the four days before.

A single track means every talk had the room to itself, so the program reads as an editorial choice. Phones were a large part of it: the Lab counts nine talks with a direct phone angle, shown in Figure 1. That classification is ours, not the organizer’s.

One detail matters for later. The phone demonstrations that drew the headlines were not separate agenda slots. The organizer’s agenda lists a keynote by researchers from Calif and a Samsung talk by another Calif researcher; Calif describes its demonstrations as shown "at Hexacon in Paris" [S2][S3].

The training days are a quieter signal. Courses before the conference covered attacking chat and messaging apps in the era of large language models, exploiting the Android kernel, iOS internals for security engineers, and baseband exploitation, the firmware that runs a phone’s radio[S15]. Training is teaching, not disclosure, and none of it is a vulnerability report. It does show where offensive attention concentrates: messaging apps, the Android kernel and the radio stack.

Our assessment: sort by disclosure, not by drama

The Lab sorts conference material into three buckets, because the right response differs for each (Figure 2).

Shown, not released. Calif’s newsletter lists four numbered demonstrations: a Signal one-click attack, an iMessage demonstration, one titled "can your iPhone do this", and a persistence demonstration it calls the "Apple Persistent Threat". Calif says everything will be released "in due time"[S3]. Press reports describe an iPhone 18 Pro on iOS 27.0.1 restarting, unlocking with its ordinary passcode and offering a root shell again [S4][S6]. Calif’s own post names no device and no software version. Heise reports that Calif will not publish an end-user tool, and that videos of the entry points show a manipulated PDF the user must open[S5]. That PDF detail comes from one outlet and is not in Calif’s post.

Nothing in this bucket has a CVE number, an Apple or Signal advisory, or a report of use against anyone.

Disclosed, with a fix path. Samsung’s September 2026 bulletin credits the same Calif researcher who spoke on Samsung’s DualDAR encryption feature for two flaws in the same driver, both rated moderate [S1][S8]. The bulletin does not say they are the flaws in the talk, so the Lab does not treat them as proven to be the same. A Google talk on Android’s data-passing mechanism lists CVE-2025-48583, a framework privilege flaw fixed in December 2025 and not flagged as exploited [S1][S9]. Apple’s iOS 27 notes credit Calif.io for four fixes, with impacts ranging from unexpected system termination to modification of protected files; two credit work done with an AI model, and none is marked as exploited or linked by Apple to the demonstrations[S7].

Research context. An independent researcher took apart Coruna, the JavaScript exploit kit that Google documented in March 2026 for iPhones on iOS 13 through 17.2.1; the components discussed target versions Apple fixed long ago [S1][S11]. A Cellebrite researcher spoke about the USB boot ROM of older Apple chips. A boot ROM is read-only silicon, so no update can fix an existing device, but the approach needs physical access and a wired connection, and no code or write-up has been published[S1]. Other talks covered browser-engine bugs found by fuzzing, with no CVE listed and a patch status the Lab could not confirm[S1], and USB exploitation, which NCC Group ties to an in-the-wild phone case documented by Amnesty International. NCC built a programmable device from low-cost boards that behaves as several cooperating USB devices, and the vector is wired and physical, needing hands on the device [S1][S12]. A university group presented a virtual iPhone platform that runs recent iOS with its security features left on, so that exploits and spyware can be studied realistically; it is a research tool, not a threat[S1].

The practical reading of the first two buckets is different from that of the third. Samsung’s bulletin and Apple’s notes are actionable now: devices that have not taken the September Samsung update remain exposed to the flaws it fixes[S8]. Context items inform judgment about the future, but call for no action beyond routine updating.

Why stored evidence matters more than live watching

A separate Calif analysis, published in September, bears on how phones can be examined. Calif found that a new Endpoint Security component in the iOS 27.2 beta stays inactive on retail iPhones, can only notify and not block, and is held by one system service. The conclusions come from disassembly and Calif lists its own caveats[S16].

The Lab’s reading is cautious: if Apple does not expose such hooks to third-party apps, security software on an iPhone still cannot watch system events as they happen. The question of what happened on a phone is then answered from what it stored, which is why the evidence families in the last section matter.

What was not shown

As of 21 October there is no public iOS 27 jailbreak, tool or CVE. Apple’s iOS 27 notes carry no entry saying Apple knows of exploitation, and iOS 27.0.1 lists no CVEs [S7][S10]. The most recent exploited-in-the-wild entry in the releases the Lab reviewed is a CoreGraphics fix in iOS 26.7.1, which Apple says applies to versions before iOS 27[S10].

Offers of an "iOS 27 jailbreak" are therefore suspect. Enthusiast sites expect survey walls, paid installers and configuration profiles to follow the news. The Lab has found no report of such a campaign yet; this is expected abuse, not an observed one.

Why the AI keynote matters more than it looks

The opening keynote abstract argues that AI models can now audit very large code bases without tiring, and that vulnerability disclosure, detection and response, and software updating may all need to change[S1]. Heise raises the concern of a shorter gap between a fix and a working exploit[S4]. These are Calif’s statements, and no demonstration has yet shown the effect at scale.

The Lab’s assessment is cautious but practical. If the gap does shorten, the value of installing updates promptly rises, and the value of an old phone left on an unpatched version falls.

What the Lab is watching

Five things will change the picture, in rough order of likelihood:

• Any Calif release of details, a proof of concept or CVE numbers.
• Apple’s next security notes, including iOS 27.0.2 and 27.2, and whether any entry gains an exploited-in-the-wild line.
• Samsung’s October and November bulletins and the Android bulletins.
• Conference slides or recordings, which may settle the device range of the boot-ROM work.
• Any security-vendor report of fake jailbreak downloads.

What this means for examiners

For an owner, the advice from the platform vendors stands: keep the phone updated, and consider Lockdown Mode if you are at elevated risk. Apple says it is not aware of successful mercenary spyware attacks against a device with Lockdown Mode on[S14]; that is a statement of non-awareness, not a guarantee.

For an examiner or a client’s adviser, the lesson is about timing. Evidence on a phone is finite and expires, and a restart can change what is there.