PlayStation 5 has leaked ROM keys — bootloader hack could get easier

O year 2026 begins with an earthquake for Sony’s security division. In the last hours of 2025, hackers confirmed the leak of PS5 chaves ROMfundamental-level codes that protect console startup.

Unlike previous software-based exploits, this leak targets the hardware root of trust, allowing developers to decrypt and analyze the device’s bootloader. PlayStation 5.

The flaw is considered impossible to correct via firmware update for units already manufactured, which could transform the modification and homebrew scenario permanently.

This incident puts the console’s security in a delicate position, similar to what happened with the PlayStation 3 in the past decade.

According to information released by the portal The CyberSec Guru, the leaked keys allow understanding the system’s “Chain of Trust” from the moment the power button is pressed.

For the community, this means that the path to a definitive jailbreak, which does not require reapplication with each reboot, is much shorter.

Hollow keys allow you to understand the system’s ‘Chain of Trust’ from the moment the power button is pressed

What are BootROM keys?

To understand gravity, you need to look at the hardware do console: o PlayStation 5 uses a custom AMD APU that contains codes physically written into the silicon during manufacturing. This is the BootROM (Level 0).

Its function is to verify that the next boot stage (the Bootloader) is legitimate and signed by Sony. The now public keys are the tools used for this verification.

To this day, most hacks exploited vulnerabilities in the Kernel (the operating system) or in the Webkit browser. Sony could close these loopholes with a simple system update. With access to ROM keys, hackers can:

• Decrypt and study the Bootloader (Level 1).
• Understand how the console validates the operating system.
• Theoretically create custom firmware (CFW) that runs natively.

Why can’t Sony fix this via software?

The term “unpatchable” (impossible to fix) is being used by experts because these keys are immutable on existing hardware. If Sony changes the keys in a software update (firmware 13.00, for example), the console’s physical BootROM will not recognize the new system and the device will not turn on.

The only definitive solution for the company would be to launch a hardware revision — a new motherboard or a “v2” model of the console with new keys engraved at the factory.

This creates a scenario where millions of consoles PlayStation sold by the end of 2025 become valuable items for preservation and modification, as they will be permanently vulnerable to future exploits derived from this leak.

Also read:

Impact on emulation and Homebrew

In addition to unlocking the physical console, the leak significantly boosts emulation on the PC Games. Emulators like shadPS4 rely on understanding exactly how the original hardware processes encrypted data.

With the keys in hand, developers can replicate the boot process with 1:1 accuracy, improving the compatibility and performance of exclusive titles running on the computer.

Although the leak does not mean that piracy will be available immediately — the system still has layers of DRM at the Kernel level — it removes the most difficult barrier to overcome.

The security community warns that users interested in homebrew (homemade software) should stop automatic updates and disconnect their consoles from the internet immediately.

This event marks the end of the “black box” era of PS5 security. As Sony evaluates its legal and engineering options, the console you have on your shelf today is, technically, much more open than it was yesterday.

Source: PS5DevWiki and The CyberSec Guru