The flaw Apple cannot patch: boot ROM bugs, usbliter8 and a conference talk

The code that runs first

When an iPhone starts, the first code it executes is stored in read-only silicon, the boot ROM. It checks the next stage of software before handing over control. Because it is physically read-only, Apple cannot repair a flaw in it for phones already built; software updates cannot reach it [S4][S5]. Only new silicon fixes the problem, which is why researchers describe such flaws as unpatchable on the affected chips.

The 2019 precedent

The last widely known case dates from 2019. CERT/CC recorded a boot ROM flaw, CVE-2019-8900, affecting Apple chips from the A5 to the A11 generations[S3]. Its lesson was that a flaw of this class outlives the devices it was found on, because the phones stay in circulation.

June 2026: a flaw for A12 and A13

On 18 June 2026 a group of researchers called Paradigm Shift published a proof of concept for a flaw in the USB controller of the A12, A13, S4 and S5 chips, press reports say [S4][S5]. With physical access, a phone in recovery mode, connected to a small microcontroller board, can be taken over before the signed boot chain loads[S4]. The affected iPhones range from the iPhone XS and XR to the iPhone 11 series and the second-generation iPhone SE; some iPads, Apple Watches and a HomePod mini use the same chips [S5][S6].

Press reports say no compromise of the Secure Enclave was shown, though the researchers warn that boot-level control might open paths to it. The A11 is not affected, and the A14 and later chips appear to be out of reach [S4][S7]. The record we could find showed no CVE assigned at the time of disclosure[S8]. We have not read the researchers’ own repository, so the Lab treats the details as press-reported.

What the Hexacon abstract says, and does not

On Saturday 17 October 2026, at 11:30, a Cellebrite Labs researcher gave a 45-minute talk at Hexacon in Paris titled "Revisiting SecureROM Adventures" [S1][S2]. We name no individual; the program does. The abstract describes a generic exploit approach for a DMA flaw in the Synopsys DWC2 USB controller across Apple chips from the A5 to the A13, along with an undocumented hardware behavior that made exploitation easier, a way of making an unreliable USB timing attack dependable, and the point where newer silicon closes the gap[S1].

A span of about eight years of hardware is implied. The A5 chip dates from about 2011, and the A13 is the iPhone 11 generation of 2019 [S1][S3]. If a single approach really covered all of them, it would be a statement about a design weakness that persisted across nine chip generations, which is why the abstract’s final topic, where newer silicon closes the gap, is the part the Lab will read first when material appears.

That is the whole of the primary record[S1]. No tool, code, write-up or CVE has appeared, and we found no statement from Cellebrite or Apple. Outlets read the device range differently, so the Lab reports the abstract’s wording as the abstract’s. We do not state that a live exploit demonstration took place. This is a conference talk, not a report of use against anyone, and it is not a statement about any company’s products.

The organizer’s program lists the speaker as a researcher at Cellebrite Labs[S1]. The Lab reads the talk as research, in the same way as the other conference talks. It is not evidence about any product, no statement from the employer was available to us, and no use against any individual has been reported.

What it takes, and what it does not do

The route is wired and physical. The phone has to be in someone’s hands, in recovery mode, with a host connected over USB [S4][S1]. Nothing in the sources describes a remote vector; it is not a message, a file or a web page. Researchers say the June flaw does not by itself defeat the Secure Enclave, the part of the chip that guards the keys protecting user data. We have no equivalent statement for the October work, because no details exist.

What we could not confirm

Some social-media posts attribute a codename, a device range and a success rate to a slide from the talk. We could not confirm any of them from a primary source, and we do not repeat them. We also could not find a published write-up, slides or recording.

Our assessment: custody is the control

The Lab reads the evidence in three layers. A real, public, unpatchable flaw exists for A12 and A13 chips. A credible talk describes ambition across A5 to A13. And no attack on an individual has been reported. The first two do not combine into an alarm; they combine into a reason to care about physical custody.

An old iPhone left in a drawer, lent out, lost or seized is the realistic setting. For such a phone, treat the passcode and the paper trail as the controls: a long passcode makes brute-force guessing far more expensive, and a chain of custody lets a later examiner say who had the phone and when.

The second part of the assessment concerns how to read the word "unpatchable". It describes the flaw, not the exposure. Apple cannot fix the ROM, but the attack still needs the phone in hand, and the sources describe no remote route. The risk is proportional to who could hold the phone: few people for most owners, and for some clients a wider circle, such as an employer that issued the handset or someone with a reason to take it.

What the Lab is watching

• Slides, a recording or a write-up that settles the device range.
• Any statement about the talk from Apple or from the speaker’s employer.
• A CVE or an Apple advisory for the June flaw.
• The A14 and later boundary, which is the line between a risk for older phones and a risk for current ones.

What this means for examiners

Treat a lost, lent or seized older iPhone as potentially exposed. Record who held it and when. Prefer retiring A12 and A13 handsets from sensitive roles. Remember that a boot-level compromise runs before the operating system, so the operating system may record little of the attack itself. Keep a custody log in the case file: who handled the phone, when, where it was stored, and whether it was ever connected to an unfamiliar computer or board. Because the route is wired, that handling history is part of the evidence.