iOS 27.2 beta reportedly adds an Endpoint Security kernel extension

A user reports spotting Endpoint Security in the iPhone’s iOS 27.2 beta kernelcache, alongside the library /usr/lib/libEndpointSecurity.dylib. A separate post describes the addition as a trimmed-down port of Apple’s Mac Endpoint Security engine and claims it monitors process injection, invalid code signatures and memory not backed by files. That post also says actions including file opens, program launches and memory-permission changes wait for an allow-or-deny decision in the kernel.