The title limit is 80 chars, if anyone wants to figure out a decent way to squeeze possibility back in there.

A US Govt iPhone-hacking suite is now possibly in criminal hands

15 chars to spare!

I think the "possibly" is supposed to mean "possibly produced by the US government"

Good point.

“Possible US-Gov-made iPhone-hacking toolkit is now in foreign and criminal hands“ ?

We try to avoid abbreviations if possible. You spurred me to take another crack at it and I think it worked this time? Happy to edit again if not...