forcequit (@forcequitOS) header
forcequit (@forcequitOS) profile picture

forcequit

@forcequitOS

I make stuff, sometimes iOS jailbreak related. Follow along for updates...

 /usr/libexec/
forcequit.cc
Joined February 2022
  • Tweets294
  • Following72
  • Followers1.2K
13Media
Photo by forcequit (@forcequitOS)Photo by forcequit (@forcequitOS)Photo by forcequit (@forcequitOS)Photo by forcequit (@forcequitOS)Photo by forcequit (@forcequitOS)Photo by forcequit (@forcequitOS)Photo by forcequit (@forcequitOS)Photo by forcequit (@forcequitOS)Photo by forcequit (@forcequitOS)Photo by forcequit (@forcequitOS)
Introducing bad_query, a zero-day sandbox escape PoC for iOS 26 and 27. This bug has been patched earlier today in iOS 27.0 beta 5, but not 26.6.1. Be careful out there, and use this for good. Coordinated release with @0xjohnny and @rooootdev :p github.com/forcequitOS/bad_q…
GitHub - forcequitOS/bad_query: Sandbox escape PoC for iOS 26 and 27.

GitHub - forcequitOS/bad_query: Sandbox escape PoC for iOS 26 and 27.

Sandbox escape PoC for iOS 26 and 27. Contribute to forcequitOS/bad_query development by creating an account on GitHub.

github.com
31
98
1
592
78,751
No one cares, but tvOS 26.6.1 adds support for the new Siri Remote to GameController.framework and TVServices.framework. The new Siri Remote has ProductID 0x316.
11
1,400
iOS 27.2 is out, so time is officially ticking for anyone interested in jailbreaking. iOS 27.0.1 signing ends: ~November 2nd, 2026 iOS 27.0.1 DelayOTA window closes: ~January 24th, 2027
44
37
2
475
43,953
It’s worth noting that these are rough estimates, the DelayOTA window specifically may last longer. If you’re on iOS 27.0 or 27.2, including betas, install 27.0.1 ASAP. Otherwise, stay where you are.
7
1
28
8,763
What are some of your favorite sideloaded apps that: - Don’t require JIT - Aren’t tweaks for existing apps - Aren’t in the App Store Please let me know, I swear this has a purpose.
16
1
78
9,037
forcequit retweeted
Mineek (@mineekdev) profile picture
Mineek@mineekdevOct 18
Hey @discord @discord_support my discord account got violations for "child safety" however the content I posted is just not a violation at all. Let's not let AI make management decisions for our accounts? Can I please speak to a human and resolve this.
16
6
52
6,921
If you’re on any iOS 27.x beta: please restore to 26.6.1 RC (heavily preferred since it has DelayOTA) or 27.0.1. If you’re on an iPhone 18 Pro (Max): install 27.0.1, it patches some important issues for usability If you’re on any other stable iOS release: *STAY WHERE YOU ARE!*
237
44
5
606
124,254
Rest in peace to maybe the most insane bug ever. This was bound to happen… I barely did anything with it, so I don’t have much to show unfortunately LOL
Image from forcequit (@forcequitOS)
13
14
656
46,646
RIP to the 2nd sandbox escape for iOS 27.x 🙃
johnny (@0xjohnny) profile picturejohnny
@0xjohnnyOct 5
Heads up: Apple patched my iOS sandbox escape, Airlift, in iOS 27.2 beta 3. Confusingly, as of now, Airlift works on 27.0, 27.0.1, 27.2b1, and 27.2b2. I'm assuming 27.1 public will have it patched as well. Remember, there are always more bugs...
2
3
95
13,475
15 Pro → 18 Pro
Image from forcequit (@forcequitOS)
17
2,260
forcequit retweeted
johnny (@0xjohnny) profile picture
johnny
@0xjohnnySep 14
To celebrate iOS 27’s release, why not release a sandbox escape? Announcing airlift: a PoC abusing a media sync path for out-of-scope access across much of /var/mobile via macOS↔iOS pairing. No MobileGestalt edits yet; looking into it. github.com/0xjohnnydev/airli…
GitHub - 0xjohnnydev/airlift: AirLift — paired-Mac AirTraffic/ATAirlock sandbox escape for iOS 27.0

GitHub - 0xjohnnydev/airlift: AirLift — paired-Mac AirTraffic/ATAirlock sandbox escape for iOS 27.0

AirLift — paired-Mac AirTraffic/ATAirlock sandbox escape for iOS 27.0 - 0xjohnnydev/airlift

github.com
8
127
9
961
91,426
And so 30 days later, iOS 26.7 RC has patched bad_query!
4
63
6,100
You’ve gotta be kidding me.
Image from forcequit (@forcequitOS)
3
63
7,890
iOS 26.6.2 does not patch bad_query and it’s been public for almost a month. Apple, what are we doing? Thanks @0xjohnny for diffing 26.6.2 in under an hour 🤝
2
12
2,392
I managed to pull off dylib embedding in Swift Playgrounds. This requires a sandbox escape (like bad_query), or maybe backup modification. Here's a demo of some App Store apps running in Playgrounds. (Enchanted LLM, Glimpse 2, Web Archive Inspector)
Image from forcequit (@forcequitOS)
Image from forcequit (@forcequitOS)
Image from forcequit (@forcequitOS)
7
1
47
4,824
I kinda did the bare minimum for this "budget LiveContainer" demo which is why I'm only demoing simple apps with no launch screens/localization/resources (and why I'm not releasing this yet). Better app support is possible though, I'll probably work on that in the future.
6
1,207
The Polishing Cloth (2026) is a disappointment to say the least. While it is a good cloth still, it simply does not match the quality of its predecessor. At least it’s half the price.
Image from forcequit (@forcequitOS)
4
16
1,864
Worth it.
Image from forcequit (@forcequitOS)
Image from forcequit (@forcequitOS)
Image from forcequit (@forcequitOS)
forcequit (@forcequitOS) profile pictureforcequit@forcequitOSAug 29
A story in three pictures.
Image from forcequit (@forcequitOS)
Image from forcequit (@forcequitOS)
Image from forcequit (@forcequitOS)
4
1
15
3,466
A story in three pictures.
Image from forcequit (@forcequitOS)
Image from forcequit (@forcequitOS)
Image from forcequit (@forcequitOS)
4
2
1
237
15,399
So 26.6.1's final release has a new build number... ...but Apple didn't patch bad_query, so there's a zero-day sandbox escape in an iOS version that released today, a week after I published bad_query and they patched it in 27.0 beta 5.
3
13
139
14,570
Probably 26.6.1 stable and maybe 27.0 beta 6 coming out on Monday? 26.6.1 stable I assume will have a different build number, and should (hopefully) patch bad_query and the other sandbox escapes
5
3
48
7,789
Load more