Leaked Document Reveals Cellebrite’s New Advanced Unlocks Product Targeting Modern iPhones

A newly leaked confidential document obtained by security researcher Justin.sh has shed light on a previously undisclosed product from digital forensics giant Cellebrite, designated as "Advanced Unlocks" or AU. The revelation, detailed in a blog post by the researcher, indicates that Cellebrite has introduced a specialized capability aimed at breaking into modern smartphones, specifically focusing on devices in an "After First Unlock" (AFU) state. This development has triggered widespread speculation within the cybersecurity community regarding the potential exploitation of undocumented zero-day vulnerabilities in Apple’s iOS hardware and software stack.

The leaked internal material differentiates the new "Advanced Unlocks" product from the broader, general-purpose "advanced unlocking services" that the company has publicly marketed to law enforcement and government agencies for years. Corporate records corroborate that Cellebrite formally laid the groundwork for this rollout earlier this year, notably highlighted by a press release detailing structural leadership changes, including the appointment of Shiven Ramji as Chief Executive Officer succeeding Thomas E. Hogan. As digital forensics tools become more sophisticated, the emergence of AU underscores the escalating technological arms race between commercial exploit vendors and mobile operating system developers.

Background and Context of Mobile Forensics and iOS Security

To understand the gravity of the leaked Cellebrite document, one must examine the state of modern smartphone security. Apple’s iOS has long been considered the gold standard for consumer privacy and data protection, utilizing advanced hardware-based security enclosures such as the Secure Enclave. When an iPhone is booted up and has not yet been unlocked by the user’s passcode for the first time, it sits in a heavily defended state known as "Before First Unlock" (BFU). In this state, file-based encryption keys are securely bound to hardware chips, rendering data extraction virtually impossible without the correct passcode.

However, once the user unlocks the device, it enters the "After First Unlock" (AFU) state. In AFU, certain decryption keys are loaded into system memory to maintain usability, allowing background processes, notifications, and applications to function smoothly. Historically, forensic tools have relied on physical access, USB-restricted mode bypasses, or software flaws to extract evidentiary data from devices stuck in the AFU state.

Cellebrite, an Israeli intelligence and digital forensics firm, has built a multi-million-dollar business model around providing law enforcement agencies, military units, and intelligence services with the capability to bypass these defenses. The introduction of "Advanced Unlocks" as a formalized, distinct product line suggests that the company has engineered novel methodologies—potentially leveraging radio-frequency (RF) or baseband vulnerabilities—to compromise devices even under stringent security postures.

Chronology of Events and the Justin.sh Leak

The sequence of events leading up to this disclosure began earlier in the year with corporate shifts at Cellebrite, signaling a strategic pivot toward advanced exploitation capabilities.

• Early 2026: Cellebrite issues a formal press release announcing executive leadership transitions, appointing Shiven Ramji as Chief Executive Officer to steer the company into its next phase of technological development.
• Mid-2026: Internal product development culminates in the formalization of "Advanced Unlocks" (AU) as a targeted commercial offering distinct from legacy services.
• October 2026: A confidential Cellebrite document detailing the technical scope and operational parameters of AU is leaked to independent security researcher Justin.sh.
• October 20, 2026: Justin.sh publishes an analysis of the leaked material on his blog, alerting the broader information security community to the existence of the product and its potential reliance on radio-based zero-day exploits.
• Present: Security analysts and vulnerability researchers begin cross-referencing the leaked parameters with known attack surfaces in iOS, focusing heavily on baseband processors and wireless stacks.

Technical Implications and the Threat of Radio Zero-Days

The most alarming aspect of the leaked Cellebrite documentation, as highlighted by independent observers, is the plausible integration of radio or wireless zero-day vulnerabilities. While traditional extraction methods often require physical connection via Lightning or USB-C ports—which Apple has systematically locked down through features like USB Restricted Mode—remote or proximity-based entry points bypass physical barriers entirely.

Modern smartphones are constantly interacting with cellular towers, Wi-Fi networks, and Bluetooth peripherals. These wireless protocols are managed by complex, low-level baseband firmware that operates independently of the primary operating system. Because baseband code runs with high privileges and handles continuous, untrusted external data streams, it represents a historically lucrative target for offensive security researchers.

If Cellebrite’s Advanced Unlocks product incorporates exploits targeting these wireless stacks, it implies that the company—or third-party exploit brokers supplying the firm—has discovered unpatched vulnerabilities in how iPhones handle radio communications. A successful radio-based exploit could theoretically allow an agency to compromise a target device without physical seizure, or to extract data from locked devices brought into proximity of specialized interception hardware.

Industry Reaction and the Silence from Cellebrite and Apple

As standard industry protocol dictates in the wake of significant zero-day leaks, neither Cellebrite nor Apple has issued an immediate, detailed technical response regarding the specific contents of the leaked document.

Cellebrite has historically maintained a strict policy of neither confirming nor denying the specific technical mechanisms behind its proprietary UFED and Premium extraction tools, citing proprietary intellectual property rights and law enforcement sensitivity. The company typically markets its solutions under strict compliance frameworks, asserting that its technology is licensed exclusively to vetted government and law enforcement entities for investigating serious crimes, counter-terrorism, and child exploitation cases.

Conversely, Apple has continuously reinforced its defensive posture through rigorous bounty programs, rapid patch deployment, and features like Lockdown Mode—an extreme, optional setting designed to protect high-risk individuals, such as journalists, dissidents, and government officials, from state-sponsored spyware and commercial forensic tools. Security engineers at Apple are undoubtedly analyzing the leaked references to determine if specific baseband or OS vectors require immediate mitigation in upcoming iOS point releases.

Broader Impact on the Commercial Exploit Market

The leak highlights the increasingly contentious intersection between commercial surveillance vendors and mainstream device manufacturers. Over the past several years, companies like Cellebrite, NSO Group, and a myriad of smaller boutique exploit brokers have faced intense regulatory scrutiny, export controls, and litigation from technology giants.

Despite these headwinds, the demand for reliable mobile unlocking capabilities remains exceptionally high among global law enforcement agencies facing the "going dark" problem—the encryption of user data that prevents investigators from accessing crucial digital evidence. The formal packaging of "Advanced Unlocks" as a distinct product category indicates that Cellebrite remains confident in its ability to source, operationalize, and monetize high-end vulnerabilities.

For the cybersecurity community, the leak serves as a stark reminder of the fragile nature of modern digital security. Every proprietary forensic tool built on undocumented flaws represents a potential risk to the general public, should those same vulnerabilities be discovered independently by malicious actors or leaked into the wild. As researchers continue to dissect the implications of Justin.sh’s findings, pressure will mount on both regulators and technology developers to address the systemic risks posed by the commercial trade in zero-day exploits.