- The IOC is a cleared shutdown log.
- The update now clears the shutdown log each boot.
> This led to the conclusion that a cleared shutdown.log could serve as a good heuristic for identifying suspicious devices.
> With iOS 26 Apple introduced a change—either an intentional design decision or an unforeseen bug—that causes the shutdown.log to be overwritten on every device reboot instead of appended with a new entry every time, preserving each as its own snapshot. This means that any user who updates to iOS 26 and subsequently restarts their device will inadvertently erase all evidence of older Pegasus and Predator detections that might have been present in their shutdown.log.