On 18 June 2026, Paradigm Shift, a security research company, published an exploit they discovered (maybe, more on that later) which they called usbliter8. It is a BootROM exploit that affects Apple A12 and A13 family chips.[1]
What is ROM and why is a boot ROM so bad?
ROM stands for read-only memory and means basically what it says on the tin. A sort of memory (generally for executable code) that is burned in at manufacture time and cannot be changed. One common usage for this is in the Boot ROM of a device, basically the minimum necessary code needed to coordinate all the hardware to turn on the device and hand off execution to the boot loader. Since this code cannot be updated, it is imperative for a device manufacturer to ensure that there are no security issues in the ROM program, meaning these programs tend to be very small with a very tiny attack surface, this makes ROM exploits very rare but extremely valuable due to their inherently un-patchable nature.
Some famous boot ROM exploits include checkm8; which allowed arbitrary code execution on Apple A4 to A11 chips[4], and (my personal favourite as a Nintendo Switch owner) Fusée Gelée; which allowed full unauthenticated arbitrary code execution on all NVIDIA Tegra SoCs up to the T186/X2[5].
How the exploit works at a high level.
This exploit takes advantage of what is believed to be a bug in the USB controller of the device. The USB protocol dictates the sort of packets that must be sent to engage in any sort of request, this bug takes advantage of the setup packets used to initiate a control transfer. A setup packet must have a payload size of 8 bytes in the specification and the USB controller will store up to three setup packets. Upon receipt of a packet, it will increment the memory address pointer by the size written to the buffer, and when three packets have been written, decrement the pointer address by 24 bytes.
However, you may notice a small issue here, namely, that the amount written is technically variable while the amount “erased” is fixed, so sending multiple setup packet with a payload under 8 bytes to trigger the buffer clear mechanism to lower the memory pointer more than intended gives one write access to memory not intended to be modified externally.
From here the researchers were able to gain control of the program counter which they could then bootstrap into arbitrary code execution[2]
What is affected?
This exploit affects all devices with an Apple A12, S4/S5, and A13 chip; the researchers also say it is technically possible to execute on the A12X/Z chips but did not implement a demo for those.
Being a boot ROM exploit, an attacker needs physical access to the device to plug it into a computer during its boot sequence to bring the device into DFU mode. All this means that this would be an incredibly targeted attack if played out in the wild, as an attacker needs to get in their hands the phone of the intended target.[2]
The lawsuit drama
This exploit was brought to light by Paradigm Shift Technology, a company dedicated to discovering zero-day exploits to sell to government agencies such as police departments. However, after going public with this exploit, they were sued by another company, Magnet Forensics, that also makes money selling zero-day exploits to governments, for stealing trade secrets (no honour among thieves eh?). Magnet alleges that Mario Del Gaudio, a former contractor of theirs who now works at Paradigm Shift stole the concept of the exploit from them and illegally used that knowledge while working with Paradigm Shift.[3] A judge has granted Magnet Forensics an injunction leading to the takedown of the original exploit announcement page (which is why it is cited in this post through an archive.org link)
Citations
[1]https://securityaffairs.com/193965/hacking/usbliter8-brings-unpatchable-bootrom-exploit-to-apple-a12-and-a13-devices.html
[2]https://web.archive.org/web/20260618141609if_/https://ps.tc/pages/blog-usbliter8.html
[3]https://www.bloomberg.com/news/articles/2026-07-17/iphone-hacking-firm-sues-ex-worker-over-alleged-theft-of-secrets
[4]https://www.kb.cert.org/vuls/id/941987/
[5]https://github.com/jevinskie/fusee-launcher/blob/n7/report/fusee_gelee.md
