Byepervisor Reborn Arrives on PS5: Hypervisor Exploit Targets Firmware 6.xx–13.60

October 14, 2026 | GoldenGames Nexus | PS5 Jailbreak News

The PS5 development scene has a new project: Byepervisor Reborn, a hypervisor exploit published by PS5Dev on GitHub, with ChendoChap listed as the repository contributor.

The project targets a vulnerability affecting PlayStation 5 firmware versions 6.xx through 13.60, although its current implementation supports only a limited selection of firmware versions.

The developers emphasize that Byepervisor Reborn is a foundational exploit intended for developers, not a ready-to-use jailbreak solution for regular PS5 owners.

Confirmed Firmware Support

According to the official GitHub documentation, the following firmware versions are currently listed:

PS5 Firmware Status

13.60 Fully supported

13.20 Fully supported

13.00 Listed as supported, but untested

6.xx–12.xx Vulnerability potentially applicable; implementation not provided for all versions

14.00 Could require modifications; not supported by this release

The developers explain that the underlying vulnerability should technically be exploitable on firmware versions as low as 6.xx.

They also mention that firmware 14.00 could potentially be supported with modifications, but no implementation for that version is included.

How Byepervisor Reborn Works

Byepervisor Reborn targets the PS5 hypervisor through a vulnerability involving the console’s S3 resume process (Rest Mode).

During system resume, the startup_mp hypercall initializes additional CPU cores. According to the repository, an insecure Nested Page Table (NPT) configuration during this process allows specially executed code to obtain read-and-write access to the hypervisor’s address space, including Virtual Machine Control Blocks (VMCBs).

The developers credit TheFlow (theflow0) with the initial discovery of the vulnerability and acknowledge subsequent work by other researchers.

The exploit uses a Rest Mode approach similar to an earlier version of Byepervisor.

What the Exploit Currently Enables

The repository identifies several technical capabilities following successful execution:

* Hypervisor memory access: Read-and-write access to the hypervisor’s address space.

* Kernel access: The system is left in a state where the kernel can be dumped and patched.

* XOM protection bypass: Execute-only memory protection for kernel text is disabled.

* Kernel writing: Write access is enabled.

* Verification notification: After resuming, the payload displays the first eight bytes of the kernel’s .text section to demonstrate the XOM bypass.

These are the capabilities described by the developers in the current repository.

Important: This Is Not a Complete HEN

Byepervisor Reborn does not include HEN patches or other ready-made system patches.

The developers explicitly describe the project as a base exploit intended for further development.

It is designed to run through elfldr, and its execution depends on the console entering and resuming from Rest Mode.

The repository also includes separate physical memory addresses for standard PS5 and PS5 Pro consoles.

The developers state that a shutdown during Rest Mode resume indicates that the exploit failed. They describe the exploit as expected to be highly stable, but this remains their stated expectation rather than independent verification.

Development and Availability

The project is built using the PS5-Payload-Dev SDK, with part of its payload running in supervisor/kernel mode.

Developers interested in adding firmware support must provide the corresponding kernel offsets and modify specific functions. Some firmware versions may require additional changes.

At the time of this report, the GitHub repository contains source code and build instructions, but no official packaged release has been published.

Conclusion

Byepervisor Reborn brings a publicly documented PS5 hypervisor exploit targeting firmware 6.xx–13.60, with current implementation support focused on 13.20 and 13.60 and untested support listed for 13.00.

Its documented capabilities include hypervisor memory access, disabling kernel execute-only protection, and enabling kernel modification.

However, the developers make one important distinction: this is a development foundation, not a complete PS5 jailbreak or HEN package for end users.

Official Source: https://github.com/PS5Dev/Byepervisor-Reborn

GoldenGames Nexus — PlayStation Homebrew & Jailbreak Development News