I’ve published a report detailing a critical, **unpatched vulnerability** in Apple’s iOS activation infrastructure.
It affects all iPhones during initial setup — even after a factory reset, with no jailbreak, no Apple ID, and no MDM.
# Key Findings:
* The Apple endpoint [`https://humb.apple.com/humbug/baa`](https://humb.apple.com/humbug/baa) **accepts unauthenticated XML provisioning payloads**
* The server responds with `HTTP 200 OK` and applies **persistent, device-level configuration chang