Unpatchable 'usbliter8' Exploit Breaks Apple A12 and A13 SecureROM Boot Chain

Summary: Researchers at Paradigm Shift published a working exploit called usbliter8 that achieves arbitrary code execution inside the SecureROM of Apple's A12 and A13 chips, code burned into the silicon at manufacture that no software update can reach. The attack requires physical possession of the device in DFU mode connected via USB to an RP2350-based microcontroller board, completes in under two seconds, and its full write-up and proof of concept went public on June 18, 2026, after coordinated disclosure with Apple Product Security.
Key Takeaway: The root cause is a hardware flaw in the Synopsys DWC2 USB controller that Apple's USB DART configuration leaves exploitable on A12 and A13, so every affected device in a sensitive role carries a permanent physical boundary loss that no patch can close. As of June 19, 2026, no CVE, Apple advisory, or CISA alert existed and no in-the-wild exploitation had been reported, but the code is public.

Read the original at The Hacker News ↗