Hi all, I’m not a developer, but I’m hoping someone with iOS system or network experience can help me understand some very persistent and unusual behavior on my iPhone. I’ve gathered system logs and app-level diagnostics and would really appreciate insight from anyone familiar with daemons, VPN tunnels, or MDM behavior on Apple platforms. Summary of Issues Over Time March 2025: Most apps begin logging out automatically when closed April 2025: Passwords across apps and browsers begin failing May–June 2025: Gmail password reset emails stop arriving (even though other email works) These symptoms suggest something affecting secure sessions, DNS routing, or background data handling. I began running diagnostics and found unexpected system and network behaviors: Examples: com.apple.mobile.lockdown.remote.trusted file_relay.shim.remote pcapd.shim.remote webinspector.shim.remote bluetooth.BTPacketLogger.shim.remote On a normal, non-jailbroken device, I wouldn't expect so many .shim.remote or .diagnostic services to be active. Is this expected on iOS 18.5? The binary /usr/sbin/scutil appears to be missing. This breaks commands like: scutil --dns scutil --proxy scutil --nc list On a standard iOS device, is it even possible for scutil to be removed or disabled? App Behavior and Config Locking (Cloudflare WARP Log) From the logs of the Cloudflare WARP app (not enterprise-managed): The app repeatedly forces VPN tunnels to reconnect or restart by injecting dummy URLs (force OS to restart the network extension process). It tries to load policy configuration from MDM and Teams APIs (even though no MDM appears in Settings). Many config items are marked as: locked: true, visible: true including: DNS logs Fallback DNS Trusted WiFi settings The account is labeled as: WarpAccountRole.child which may explain some restrictions — but I’ve never set this manually. This seems more advanced than what the standard WARP app does. Could a provisioning profile or side-loaded config be applying these? Key Questions for the Community Are ~50 remote diagnostic services (.shim.remote) normal on iOS 18.5 stock devices? Could a VPN app (e.g. WARP) or hidden config enforce flow-switching across interfaces like ipsec, awdl, and pdp_ip, even when not visibly active? Can a provisioning profile or managed config enable services like file_relay, pcapd, or webinspector silently — without any visible MDM profile? Has anyone seen scutil or other network tools missing on a stock iPhone? What could cause this? Does WARP in MASQUE mode normally lock DNS settings and force tunnel restarts — or could this indicate tampering? If anyone on iOS 18.5 / iPhone17,1 can share their remotectl_dumpstate output, I'd love to compare. Happy to share sanitized logs or run more tests if helpful. Thank you for any insights — especially from those familiar with internal services, VPN frameworks, or supervised profiles. get-network-info.txt remotectl_dumpstate.txt assetsd.diskwrites_resource-2025-06-25-221428.json More network info.txt linkText](https://www.example.com/)

O v er the past few months, I’ve been experiencing persistent, abnormal behavior on my iPhone. Here's a short timeline: March 2025: Most apps log me out every time I close them. April 2025: Stored passwords suddenly begin failing across apps and websites. May–June 2025: Password recovery emails from Gmail accounts no longer arrive — suggesting that Gmail itself may be compromised or blocked/intercepted. Given the escalation, I ran several diagnostics and extracted system-level logs. Below is a structured summary of findings that point toward potential remote access, network traffic rerouting, and possibly hidden use of Bluetooth or debugging interfaces. ##1 Source: remotectl_dumpstate.txt More than 50 remote lockdown and diagnostic services are listed as active. Notable entries: com.apple.mobile.lockdown.remote.trusted and .untrusted com.apple.mobile.file_relay.shim.remote com.apple.webinspector.shim.remote com.apple.pcapd.shim.remote com.apple.bluetooth.BTPacketLogger.shim.remote com.apple.mobile.insecure_notification_proxy.remote This volume of .shim.remote and diagnostic services appears highly irregular for a non-debug, non-jailbroken device. 2. Skywalk Network Flows and Unusual Routing Source: skywalk.txt Dozens of flowswitch entries across interfaces like: ipsec0-7, pdp_ip0-2, en0-2, awdl0 Apps such as Gmail, ChatGPT, Preferences, and com.apple.WebKit are marked as defunct, yet persist in flow tables. Two specific daemons — replicatord and siriactionsd — appear on nearly every interface, in both QUIC and TCP6 traffic. skywalkctl flow-route shows multiple external IP paths, with flows routed through ipsec7, owned by kernel_task.0 — which could indicate system-level tunneling. 3. System Anomalies and Resource Behavior Inaccessible System Network Tools Source: get-network-info.txt All scutil calls fail (/usr/sbin/scutil does not exist). This blocks access to: DNS configuration (scutil --dns) Proxy and VPN status (scutil --proxy, --nc list) Reachability checks (scutil -r www.apple.com) Key Questions for the Developer Community Are >50 remote .shim.remote services typical on iOS 18.5 (release build)? Or does this suggest tampering, an MDM configuration, or debug provisioning? Could a misconfigured VPN or MDM profile enable persistent flow-switching across multiple interfaces (e.g., ipsec, pdp, awdl) and reroute app traffic such as Gmail? Is it possible for a test or developer certificate to silently side-load a background daemon, or trigger services like pcapd or file_relay, without showing in Profiles or Settings? Has anyone else seen the scutil binary missing or inaccessible on a stock iPhone? Could this be a sign of intentional lockdown or system modification? If anyone on iOS 18.5 / iPhone17,1 can share their remotectl_dumpstate output, I'd like to compare the service count and see if this behavior is reproducible. I’d appreciate any insight from those familiar with Apple’s system daemons, skywalk internals, or network service behavior. Happy to share sanitized logs or run additional diagnostics if needed. Thanks in advance. get-network-info.txt route-info.txt remotectl_dumpstate.txt [ assetsd.diskwrites_resource-2025-06-25-221428.json linkText

Over the past few months, I’ve been experiencing persistent, abnormal behavior on my iPhone. Here's a short timeline: March 2025: Most apps log me out every time I close them. April 2025: Stored passwords suddenly begin failing across apps and websites. May–June 2025: Password recovery emails from Gmail accounts no longer arrive — suggesting that Gmail itself may be compromised or blocked/intercepted. Given the escalation, I ran several diagnostics and extracted system-level logs. Below is a structured summary of findings that point toward potential remote access, network traffic rerouting, and possibly hidden use of Bluetooth or debugging interfaces. ##1 Source: remotectl_dumpstate.txt Notable entries: com.apple.mobile.lockdown.remote.trusted and .untrusted com.apple.mobile.file_relay.shim.remote com.apple.webinspector.shim.remote com.apple.pcapd.shim.remote com.apple.bluetooth.BTPacketLogger.shim.remote com.apple.mobile.insecure_notification_proxy.remote This volume of .shim.remote and diagnostic services appears highly irregular for a non-debug, non-jailbroken device. 2. Skywalk Network Flows and Unusual Routing Source: skywalk.txt Dozens of flowswitch entries across interfaces like: ipsec0-7, pdp_ip0-2, en0-2, awdl0 Apps such as Gmail, ChatGPT, Preferences, and com.apple.WebKit are marked as defunct, yet persist in flow tables. Two specific daemons — replicatord and siriactionsd — appear on nearly every interface, in both QUIC and TCP6 traffic. skywalkctl flow-route shows multiple external IP paths, with flows routed through ipsec7, owned by kernel_task.0 — which could indicate system-level tunneling. 3. System Anomalies and Resource Behavior Inaccessible System Network Tools Source: get-network-info.txt All scutil calls fail (/usr/sbin/scutil does not exist). This blocks access to: DNS configuration (scutil --dns) Proxy and VPN status (scutil --proxy, --nc list) Reachability checks (scutil -r www.apple.com) Key Questions for the Developer Community Are >50 remote .shim.remote services typical on iOS 18.5 (release build)? Or does this suggest tampering, an MDM configuration, or debug provisioning? Could a misconfigured VPN or MDM profile enable persistent flow-switching across multiple interfaces (e.g., ipsec, pdp, awdl) and reroute app traffic such as Gmail? Is it possible for a test or developer certificate to silently side-load a background daemon, or trigger services like pcapd or file_relay, without showing in Profiles or Settings? Has anyone else seen the scutil binary missing or inaccessible on a stock iPhone? Could this be a sign of intentional lockdown or system modification? If anyone on iOS 18.5 / iPhone17,1 can share their remotectl_dumpstate output, I'd like to compare the service count and see if this behavior is reproducible. I’d appreciate any insight from those familiar with Apple’s system daemons, skywalk internals, or network service behavior. Happy to share sanitized logs or run additional diagnostics if needed. Thanks in advance. get-network-info.txt remotectl_dumpstate.txt assetsd.diskwrites_resource-2025-06-25-221428.json

Over the past few months, I’ve been experiencing persistent, abnormal behavior on my iPhone. Here's a short timeline: March 2025: Most apps log me out every time I close them. April 2025: Stored passwords suddenly begin failing across apps and websites. May–June 2025: Password recovery emails from Gmail accounts no longer arrive — suggesting that Gmail itself may be compromised or blocked/intercepted. Given the escalation, I ran several diagnostics and extracted system-level logs. Below is a structured summary of findings that point toward potential remote access, network traffic rerouting, and possibly hidden use of Bluetooth or debugging interfaces. Device Information Model: iPhone17,1 (A17 chip) iOS Version: 18.5 (Build 22F76) Status: Stock, not jailbroken or running a developer build Region: Netherlands Carrier: KPN NL Language/Locale: Dutch (nl-NL) 1. Evidence of Remote Services and XPC Connectivity Source: remotectl_dumpstate.txt More than 50 remote lockdown and diagnostic services are listed as active. Notable entries: com.apple.mobile.lockdown.remote.trusted and .untrusted com.apple.mobile.file_relay.shim.remote com.apple.webinspector.shim.remote com.apple.pcapd.shim.remote com.apple.bluetooth.BTPacketLogger.shim.remote com.apple.mobile.insecure_notification_proxy.remote This volume of .shim.remote and diagnostic services appears highly irregular for a non-debug, non-jailbroken device. 2. Skywalk Network Flows and Unusual Routing Source: skywalk.txt Dozens of flowswitch entries across interfaces like: ipsec0-7, pdp_ip0-2, en0-2, awdl0 Apps such as Gmail, ChatGPT, Preferences, and com.apple.WebKit are marked as defunct, yet persist in flow tables. Two specific daemons — replicatord and siriactionsd — appear on nearly every interface, in both QUIC and TCP6 traffic. skywalkctl flow-route shows multiple external IP paths, with flows routed through ipsec7, owned by kernel_task.0 — indicate tunnelling? 3. System Anomalies and Resource Behavior Inaccessible System Network Tools Source: get-network-info.txt All scutil calls fail (/usr/sbin/scutil does not exist). This blocks access to: DNS configuration (scutil --dns) Proxy and VPN status (scutil --proxy, --nc list) Reachability checks (scutil -r www.apple.com) The absence of scutil is not expected right? Unusual Resource Usage Source: assetsd.diskwrites_resource-2025-06-25.json assetsd, working on behalf of cloudphotod, wrote over 1 GB of memory-backed files in under 1.5 hours. 4. Metadata Confirmation Source: Analytics-2025-06-27-020008.json Confirms: iPhone capacity: 256 GB DRAM: 7.5 GB Carrier: KPN NL Apps marked as highly active ("Games", "Creativity") in analytics also appear as defunct in skywalk, suggesting ghost background processes. Key Questions for the Developer Community Are >50 remote .shim.remote services typical on iOS 18.5 (release build)? Or does this suggest tampering, an MDM configuration, or debug provisioning? Could a misconfigured VPN or MDM profile enable persistent flow-switching across multiple interfaces (e.g., ipsec, pdp, awdl) and reroute app traffic such as Gmail? Is it possible for a test or developer certificate to silently side-load a background daemon, or trigger services like pcapd or file_relay, without showing in Profiles or Settings? Has anyone else seen the scutil binary missing or inaccessible on a stock iPhone? Could this be a sign of intentional lockdown or system modification? If anyone on iOS 18.5 / iPhone17,1 can share their remotectl_dumpstate output, I'd like to compare the service count and see if this behavior is reproducible. I’d appreciate any insight from those familiar with Apple’s system daemons, skywalk internals, or network service behavior. Happy to share sanitized logs or run additional diagnostics if needed. Thanks in advance. get-network-info.txt route-info.txt remotectl_dumpstate.txt [ assetsd.diskwrites_resource-2025-06-25-221428.json

Hi all, Well Im about to publish an app for iOS and the process is almost done but I don't know how is it to publish the same for MacOS, I mean, I can generate the app file from my engine (Unity) and even run it, but from there what are the steps? do we need to pass this to Xcode too? if so please direct me to where its explained because I couldn't find it, thanks a lot for any help

Hello, I’m wanting to install macOS 26 on a partition on my MacBook Pro so I can use the fully featured Xcode Beta. I was able to create the partition but am having trouble figuring out how to install the operating system on the partition because on the developer downloads site there is only .ispw files. What are the steps to do this successfully? Thanks. Kevin

Since a recent macOS update (around one month ago), I’ve been experiencing a random issue on my MacBook Air (2023, M2). After the device enters sleep mode and I try to wake it, sometimes the screen stays black with only the cursor visible. The issue occurs randomly — not every time — but frequently enough to impact daily use. The system becomes completely unresponsive, and the only recovery method is a forced restart (holding the power button). Steps to Reproduce: 1. Leave the MacBook idle until it enters sleep automatically. 2. Wait for 10–30+ minutes. 3. Attempt to wake it using the keyboard, trackpad, or by opening the lid. 4. Randomly, the system fails to wake properly: screen turns on, shows a black background with a movable cursor, but nothing else appears. Expected Result: The system wakes normally and restores to the previous desktop session. Actual Result: The system randomly freezes on a black screen with a visible cursor. No user interface or login prompt appears. Requires a hard restart. System Information: • Device: MacBook Air 13”, M2, 2023 • macOS Version: [Insert exact version, e.g., macOS Sonoma 14.5] • Issue Since: Around one month ago (possibly after latest macOS update) • Peripherals: [Mention any external devices if applicable] • Reproducibility: Random (approximately 30–50% of the time after longer sleep) Additional Notes: • Issue is not consistent; sometimes the system wakes as expected. • Occurs regardless of whether on battery or plugged in. • No external monitors or USB accessories are connected when this happens.

Hi guys, good afternoon, I just updated to mac os tahoe and it works great on the mac, but at the moment the wifi and bluetooth connection are not working. I would like to ask for a little support, I have not installed little snitch.app or anything, it is a mac book pro, I hope you can help me, greetings!

Hi all, Im trying to upload an app to the App Store, the app is made in Unity, well I built the app there and then open the Xcode project, from there set some fields and now when I have to go to Product>> Archive I get an error always, could you please tell me what is this and how to fix? unsupported option -mno- thumb for target arm64-apple-ios 15.6 Im using Xcode 16.4 which I think is the latest version released. Thanks for any clue about this, Im really lost

As soon as I launch, Mail and Safari crash. I hope this is temporary. Tahoe 26.0 Beta

In the software update in the settings if I open the software update, which is showing that could not update because I accidentally turned off the beta updates and it is showing error or something

m personal iPhone is managed by an Unauthorized and Unknown mdm management team, The profile isn’t showing up in VPN Settings and I can’t remove them from having Remote access and control over my Personal Device! I’ve SPENT MANY MONTHS TRYING TO GET SUPPORT VIA EMAILING APPLE DEVELOPER AND SPEAKING TO APPLE SUPPORT WHICH HAS BEEN EXTREMELY EXHAUSTING AND HUMILIATIN! I’ve resorted to contacting Internet crime websit, the federal trade commissio, Better business bureau and Consumer Affairs to file an online complaint against Apple for not complying with their Security and Privacy policy for consumers accounts! Because of this unauthorized and unknown mdm devi management profile I don’t have COMPLETE CONTROL OVER MY OWN IPHONE! !

Hello everyone, I’m having an issue with the Photos app on my iPhone 13 Pro running iOS 26 Beta 2 (happened in first Beta as well). When I open the Photos app and go to the Collections section, it’s completely blank — no photos, just empty space. The library seems to be working fine and my photos show up in the Library. I’ve tried restarting the phone and force-quitting the app, but no change. Could it be a bug? Also, I just switched from Android to IOS, one week ago, if this detail helps. Is anyone else experiencing this issue? Any fixes or suggestions? Thanks in advance!

After installing iOS 26 Developer Beta on my iPhone 13 mini, I encountered a critical battery issue. The battery percentage was stuck at 1%, and the phone could only be used while continuously plugged in. Despite the low reading, the device remained fully functional — I could use apps, navigate, and perform tasks normally. However, the battery indicator never rose above 1%, and the Battery Health section in Settings showed 0% Maximum Capacity, which is inaccurate. I did not allow the phone to fully discharge, out of fear that it might not turn back on. Restarting the phone and changing cables or chargers had no effect. After restoring the device to iOS 18.7.2 using DFU mode, the issue disappeared entirely — the battery percentage behaved normally again and the health section showed the correct value (about 100%). Observed behavior: • Battery percentage frozen at 1% • Maximum Capacity reported as 0% • Device only functional while connected to power • Issue resolved immediately after restoring to iOS 18 Temporary solution: A DFU restore to iOS 18 (18.5 22F76) immediately resolved the issue. The battery percentage and health readings returned to normal. Additional information: • Charger used: Official Apple 20W USB-C charger • Cable used: Apple USB-C to Lightning cable • Battery health after restore: 100% (replaced)

Latest ios cannot perform screenshot

I’ve updated to iOS 26 Beta 1, and now I can’t revert to an earlier version because my iPhone automatically created a backup using the iOS 26 version. I’m also unable to check for updates—my device can’t retrieve information from the server, so it’s not detecting that Beta 2 is available. I need help resolving this issue, please.

After i install ios 26 i can’t go back to other videos after i comment on tiktok videos

With iOS 26.0 (23A5276f) I can’t make calls via Bluetooth on any device. Any workaround?

Calling button flickers when making a call after updating to ios 26 beta 2 kindly solve the issue asap

I've got the initial WWDC beta of macOS 26 (25A5279m) installed inside a virtual machine (UTM), but can't seem to update to the second beta. Nothing is showing up within Software Update. Is this because it's within a VM, or am I doing something wrong? It'd be a real pain to have to install a new VM afresh with the RestoreImage for every update.