Leaked Cellebrite Flyer Claims Remote iPhone Unlocking From 8 Meters

A confidential Cellebrite flyer has surfaced online. The company sells phone-cracking tools to police and forensic labs. The flyer describes a product that allegedly opens locked iPhones without touching them. It also claims the product works with Apple’s Stolen Device Protection turned on.

An independent security blogger got the document and posted it on justin.sh. The post is titled “Is Cellebrite sitting on an iPhone radio 0day?” Security researcher Bruce Schneier then shared it under the headline “Possible new Cellebrite iPhone Radio Zero-Day.” Since then, privacy sites have picked up the story.

Details of the alleged flyer’s iPhone unlocking claims

Cellebrite calls the product Advanced Unlocks. The flyer says it runs from a single dedicated device with a range of about 8 meters. It lists the iPhone 11 through iPhone 16 as supported models.

The flyer also describes Advanced Unlocks as a new way into phones that holds up better against Apple’s software changes. It says labs are increasingly shut out of evidence on the newest iPhones. In other words, Cellebrite is selling a fix for that problem.

The flyer does not explain how the device reaches a phone. However, the range rules out a cable. A radio signal is the likely answer.

The product works on phones in a state called “after first unlock.” Your iPhone enters that state once you type your passcode after a restart. Encryption keys then stay in the phone’s memory. Because of that, the phone is easier to attack than one that has just restarted.

The product is real, but the details are thin

Cellebrite has sold Advanced Unlocks for months. According to Cyber Kendra, the company listed new advanced unlock features as a growth driver in its February 11 results. Its August 13 earnings release said customers were adopting the product. Executives also said the second quarter was its first full quarter on sale.

Those filings do not explain how the product works. Cellebrite also offers it only on a limited basis, according to the same report. That means most forensic labs may not have it yet. Meanwhile, a Privacy Guides forum member noted that the flyer is a few months old. The document also leaves out the iPhone 17 and the newest software.

Meanwhile, another platform-related privacy concern has emerged after leaked X code suggested the company was developing a mandatory facial biometric verification system. The proposal raises separate questions about how technology platforms handle users’ identities and personal data.

Why the blogger suspects Bluetooth

The blogger believes the device uses a Bluetooth bug that Apple has since patched. No one has proven this. It is an educated guess based on the 8-meter range.

Apple’s own security page offers a clue, though not proof. iOS 26.7 came out on September 14. Its notes list a fix in the Bluetooth component under the code CVE-2026-65414. Cyber Kendra reports that the flaw could let a remote attacker run code on a phone. However, Apple made no mention of any such use of the vulnerability. No reports link it to Cellebrite.

The device list adds another hint. The iPhone 17 and iPhone Air use a hardware defense Apple calls Memory Integrity Enforcement. It is built to block the bugs that most attacks depend on. The flyer stops right before those phones. This matches the notion that hardware updates plug the loophole. Yet, it is a pattern, not a definite cause.

Many questions still need clarification. Cellebrite has not said whether the flyer is genuine. Neither Cellebrite nor Apple had commented publicly as of October 21.

No one knows whether Advanced Unlocks still works on iOS 26.7 or later. We also don’t know how many labs own one. In addition, the flyer says nothing about price or legal limits on use.

Social media posts have gone further than the evidence. Some claim anyone nearby could unlock your phone at a coffee shop or airport. The flyer does not say that. It describes a tool for forensic labs. Also, a stated range is a sales claim, not a test result.

What iPhone owners should do to protect their device

You don’t need to panic. Still, a few simple steps cost nothing. First, install the latest iOS update. Apple’s September release fixed Bluetooth problems, and updates closed holes like these.

Second, restart your phone from time to time. A restart returns it to the state before the first unlock. According to Cyber Kendra, an attack built for the after-first-unlock state cannot use that mode. Likewise, Apple added an automatic restart feature to make phones harder to attack.

Third, turn off Bluetooth in the Settings app when you don’t need it. The Control Center switch only disconnects your devices. It does not disable Bluetooth.

Finally, be realistic. Cellebrite develops forensic software for the police, which is specifically designed to access confiscated devices. Most people will never face one. Even so, the leak shows how hard companies work to get around Apple’s defenses. It also shows how quickly Apple has to patch.

What’s next?

The next clue will likely come from Apple or Cellebrite. If either company responds, we may learn whether the flyer is real. Independent researchers might look into the Bluetooth angle someday, but right now, it’s still just a theory. So it’ll be wise not to take these claims as facts yet.