---
title: "Cellebrite reportedly holds an unpatchable iPhone exploit while its stock sits 45 percent off its high"
description: "A Hexacon slide, as reported by one specialist blog and one X account, says Cellebrite can still break Apple silicon at its deepest layer, though only up to the iPhone 11, and the company has confirmed nothing. Third-quarter earnings on November 11, 2026, decide whether the capability converts into contracts."
publisher: "The Inference"
section: "Markets"
published: 2026-10-18T23:05:12.932Z
modified: 2026-10-18T23:05:12.932Z
canonical: https://theinference.org/article/cellebrite-reportedly-holds-an-unpatchable-iphone-exploit-while-its-stock-sits-45-percent-off-its-high
language: en
keywords: "Cybersecurity, Markets, Apple, Earnings, Israel"
---

# Cellebrite reportedly holds an unpatchable iPhone exploit while its stock sits 45 percent off its high

> A Hexacon slide, as reported by one specialist blog and one X account, says Cellebrite can still break Apple silicon at its deepest layer, though only up to the iPhone 11, and the company has confirmed nothing. Third-quarter earnings on November 11, 2026, decide whether the capability converts into contracts.

[Cellebrite](https://theinference.org/markets/companies/cellebrite) [reportedly unveiled LOKI at the Hexacon security conference](https://pasqualepillitteri.it/en/news/24946/cellebrite-unveils-loki-boot-rom-exploit-apple-chips) this week: a boot ROM exploit covering [Apple](https://theinference.org/markets/companies/apple) chips from the iPod touch 2 to the iPhone 11 [1][2]. Boot ROM code is burned into the chip at manufacture, so no software update can ever close it [2]. The slide calls it a timing race that early proofs of concept won roughly once in 25 tries, and it needs the phone physically in hand, in DFU mode, the device's deepest recovery state [1][2].

Cellebrite, the Israeli forensics vendor whose extraction kits sit inside police forces, intelligence agencies and corporate investigators, has confirmed none of it; the account rests on one specialist blog and [one X post](https://x.com/IntCyberDigest/status/2111419349114245410) [1][2]. The market verdict is scheduled anyway: third-quarter results land on November 11, 2026, against a $145.89 million revenue consensus [3].

## The hole is permanent; the covered fleet only shrinks

Unpatchable means every affected device stays open forever, and it means the covered base only shrinks: LOKI stops at the iPhone 11, and the DFU requirement rules out anything remote or industrial-scale [1][2]. The capability runs deep, and it has a built-in ceiling.

## The buyers keep signing in public

The government of Puebla, Mexico [is tendering for two Cellebrite extraction systems](https://puebla.contrareplica.mx/nota-Gobierno-de-Puebla-licita-equipos-Cellebrite-para-extraer-y-analizar-datos-de-celulares-en-investigaciones2026161037) plus a package of 150 unlocks for advanced devices, with the award due between November 6 and 11, 2026, and eight state attorney general staff lined up for training [4].

The rival supply is thinning too. [Federal prosecutors charged Lee Reiber](https://www.cnbc.com/2026/09/25/tech-ceo-russian-national-charged-with-hiding-firms-russian-ties.html), chief executive of the Virginia-based competitor Oxygen Forensics, and a Moscow businessman with conspiracy to commit wire fraud for allegedly hiding the firm's Russian ownership; investigators seized its bank accounts and roughly 57 web domains [5]. With that rival sidelined, Cellebrite is the listed incumbent for agencies that still need phones opened, and management guided third-quarter revenue to $145 million to $148 million [3], against $126.03 million a year earlier [6].

*Chart: **Quarterly revenue is up 56 percent in three years** Cellebrite quarterly revenue from Q3 2023 to Q2 2026, rising from $84.18 million to $131.14 million, with the Q3 2026 guidance midpoint drawn as an estimated reference line above the latest quarter*

*Quarterly reported revenue, USD millions, from Cellebrite's SEC filings, Q3 2023 through Q2 2026; reference line is the midpoint of management's Q3 2026 revenue guidance of $145 million to $148 million, an estimate. [3][6]*

## Nine Buy ratings against one August day

The bull case is documented: second-quarter revenue of $131.14 million, up 16 percent; annual recurring revenue of $508 million, up 21 percent; defense and intelligence ARR up 25 percent [7]. [Nine analysts rate the stock Buy and none Sell](https://www.ad-hoc-news.de/boerse/news/nebenwerte/cellebrite-stock-trades-23-95-percent-below-usd-14-13-consensus-target/70333022), at a $14.13 consensus target [7].

What that does not resolve is August 13, 2026: ARR of $507.8 million, below the company's own $510 million to $513 million projection; a full-year ARR cut of roughly $15 million at the midpoint, blamed on a foreign-entity permit requirement applied to cloud technology; chief executive Tom Hogan replaced, effective immediately, by Shiv Ramji; and [a 29 percent single-day fall to $10.80](https://www.newmediawire.com/news/kaplan-fox-reminds-cellebrite-di-ltd-nasdaq-clbt-investors-of-an-ongoing-securities-law-investigation-7090399) [8]. Kaplan Fox, a plaintiffs' securities firm, is investigating potential violations [8].

## The stock, and the stake that showed up

The stock [closed at $11.03 on October 16](https://www.ad-hoc-news.de/boerse/news/nebenwerte/cellebrite-stock-falls-3-08-percent-44-79-percent-below-its-52-week-high/70350938), 44.79 percent below its $19.98 high, at 47.16 times trailing earnings [3]. Along for the ride sits Pertento Partners, an investment firm that [filed a passive Schedule 13G on October 9](https://kalkine.com/news/announcements/pertento-partners-discloses-52-stake-in-cellebrite) disclosing 5.2 percent of the company, held for advisory clients with no intent to influence control [9].

*Chart: **Closer to the 52-week floor than to the consensus target** Cellebrite's $11.03 close sits just above its $9.58 52-week low, below the $14.13 analyst consensus target and far under the $19.98 high*

*Nasdaq prices in USD; close and 52-week range as of October 16, 2026; consensus target from nine analysts as of October 14, 2026, an estimate. [3][7]*

## November 11 settles it

Puebla's award window opens on November 6; Cellebrite reports third-quarter results on November 11 [3][4]. The tell is ARR: re-acceleration toward the $550 million to $560 million full-year range [10] says capability still converts into contracts; a second cut, on top of the August permit drag [8], says the overhang is the business. The silicon hole is permanent; the credibility hole from August is the one management has to close on November 11.

## Takeaway

Cellebrite's reported LOKI boot ROM exploit is unpatchable but capped at the iPhone 11 and DFU-only, while the stock's real overhang is the August ARR cut; November 11 earnings decide whether the capability converts into contracts.

## Sources

1. [Pasquale Pillitteri, Cellebrite unveils LOKI, a boot ROM exploit for Apple chips, 18 October 2026](https://pasqualepillitteri.it/en/news/24946/cellebrite-unveils-loki-boot-rom-exploit-apple-chips)
2. [@IntCyberDigest on X, Cellebrite unveiled zero-day LOKI, a boot ROM exploit for Apple chips from iPod touch 2 to iPhone 11, 17 October 2026](https://x.com/IntCyberDigest/status/2111419349114245410)
3. [ad-hoc-news.de, Cellebrite stock falls 3.08 percent, 44.79 percent below its 52-week high, 18 October 2026](https://www.ad-hoc-news.de/boerse/news/nebenwerte/cellebrite-stock-falls-3-08-percent-44-79-percent-below-its-52-week-high/70350938)
4. [ContraRéplica Puebla, Gobierno de Puebla licita equipos Cellebrite para extraer y analizar datos de celulares, 16 October 2026](https://puebla.contrareplica.mx/nota-Gobierno-de-Puebla-licita-equipos-Cellebrite-para-extraer-y-analizar-datos-de-celulares-en-investigaciones2026161037)
5. [CNBC, Virginia tech firm's CEO, Russian national charged with hiding firm's Russian ties from US government, 25 September 2026](https://www.cnbc.com/2026/09/25/tech-ceo-russian-national-charged-with-hiding-firms-russian-ties.html)
6. [Cellebrite, quarterly revenue from its SEC filings, retrieved 18 October 2026](https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&CIK=0001854587)
7. [ad-hoc-news.de, Cellebrite stock trades 23.95 percent below USD 14.13 consensus target, 16 October 2026](https://www.ad-hoc-news.de/boerse/news/nebenwerte/cellebrite-stock-trades-23-95-percent-below-usd-14-13-consensus-target/70333022)
8. [Kaplan Fox & Kilsheimer via NewMediaWire, Kaplan Fox reminds Cellebrite investors of an ongoing securities law investigation, 7 October 2026](https://www.newmediawire.com/news/kaplan-fox-reminds-cellebrite-di-ltd-nasdaq-clbt-investors-of-an-ongoing-securities-law-investigation-7090399)
9. [Kalkine, Pertento Partners discloses 5.2% stake in Cellebrite, 15 October 2026](https://kalkine.com/news/announcements/pertento-partners-discloses-52-stake-in-cellebrite)
10. [ad-hoc-news.de, Cellebrite stock holds at USD 11.62 as 2026 targets stay intact, 23 September 2026](https://www.ad-hoc-news.de/boerse/news/nebenwerte/cellebrite-stock-holds-at-usd-11-62-as-2026-targets-stay-intact/70160936)


---

Cellebrite reportedly holds an unpatchable iPhone exploit while its stock sits 45 percent off its high — The Inference. Canonical: https://theinference.org/article/cellebrite-reportedly-holds-an-unpatchable-iphone-exploit-while-its-stock-sits-45-percent-off-its-high