Apple patches AirLift bug, closing carrier profile bypass on iPhone
A sandbox escape that allowed unauthorized carrier tweaks to enable 5G and VoWiFi in Russia has been sealed in iOS 27.2 beta 3.
In Apple's latest test build, iOS 27.2 beta 3, the company resolved the AirLift vulnerability. The flaw previously allowed utilities to step outside the platform's standard sandbox via the system's desktop synchronization plumbing.
The bypass served as the foundation for CarrierSIM, a community project that tricked locked-down devices into swapping out carrier profiles without requiring a full jailbreak. By abusing the AirTraffic syncing interface discovered in iOS 27.0, the tool wrote configuration files into protected directories.
That mechanism was specifically used to enable 5G and VoWiFi on iPhones running on Russian networks. Because official carrier bundles disable 5G in the region following Apple's business suspension, the script assigned local SIM cards the built-in profile of Vodafone Hungary, unblocking the dormant networking toggles.
The workaround was already brittle: it required a desktop connection via Python and iTunes, and the settings reset after every device reboot. Furthermore, mobile 5G in Russia remains mostly experimental and confined to isolated test zones, meaning real-world performance gains were minimal even before the loophole closed.
With beta 3 plugging the directory traversal bug, the method stops functioning entirely on updated software, leaving anyone relying on the script anchored to older builds.
Source: habr
Comments
Help shape the next version: Add context or suggest a correction. AI review can add points toward a rewrite. Reviews and updates may take time; a full meter does not guarantee a new version.