Calif.io Brotli exploit hits iPhone, iPad and Mac via Wi-Fi portal
Security team Calif.io has shown another Apple exploit: opening a Wi-Fi captive portal is enough to trigger a Brotli bug and jailbreak an iPhone, iPad or Mac.
SUMO· the number puzzle
Dialo· learn languages by speaking
ediviewer· read EDI files like documents
giftdetect· the right gift in minutesYou join a Wi-Fi network, the sign-in page pops up, you tap through it. Most of us never think twice. According to security team Calif.io, that moment can be enough to compromise an Apple device.
The researchers have shown another exploit, the next in a series of attacks from the group. This one uses a flaw in Brotli, a data compression format, to jailbreak devices. The trigger is a captive portal, the login page that hotels, cafés and airports show before you get online. Opening it is all it takes.
Which Apple devices are affected?
The exploit is described for iOS, iPadOS and macOS, so iPhones, iPads and Macs are all in the frame. A jailbreak means breaking out of the limits Apple builds into its software, which is exactly what you don't want happening to your own phone without you knowing.
What should you do about it?
Update your Apple device as soon as possible. That is the advice that comes with the news, and it is the simple part: open the software update section in Settings on iPhone and iPad, or System Settings on a Mac, and install whatever is waiting.
The flaw sits in how a compression format is handled, not in anything you have to click or approve. That is why a portal page you would normally ignore became the way in.
Apps worth a look
SUMO: the number puzzleTap the right tiles, add them up, hit the target. Easy to learn, hard to master. Free, for all ages.
Dialo: learn languages by speakingTalk to an AI conversation partner; every sentence comes back corrected and explained in your language. 9 languages, A1 to C2.
ediviewer: read EDI files like documentsOpen EDIFACT and X12 messages, see every segment explained, convert to JSON/XML, export PDF and Excel. Runs locally, no upload.
giftdetect: the right gift in minutesPick who it is for, the occasion and their personality. The search engine reads product descriptions from local shops and ranks what fits. Free, no sign-up.
More from this day
See all →
The Logos: a Finnish cathedral plays fast radio bursts every day
Signal encryption code verified by DeepMind AI in four weeks
Mittwald hosting attack via MCP server: site in emergency mode
