Beach2Shell

What is Beach2Shell?

Beaches are unauthenticated, publicly accessible distribution points for shells. The attacker walks to the endpoint, bends at the waist, and picks one up, gaining immediate arbitrary command execution.

This exploit has gone largely undetected for roughly 200,000 years. The earliest known threat actors are toddlers, who achieve reliable shell access with minimal security experience, and Redditors.

Indicators of compromise

If you notice a child running toward you at full speed in your environment, you've likely already been compromised. Immediately terminate the child process and pray the shell is dropped. Other IoCs may include tan lines or sandy hair.

Scoring

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

The ocean is, by definition, a network. It has connected every continent for the last 200 million years. It delivers shells to 150+ countries simultaneously, on a predictable six-hour tide cycle, with no rate limiting. It predates TCP by a few years, per our estimates.

Conventional analysts score this as Physical because the attacker has to be present, but who cares what they have to say, anyway?

Exploitation

If you require exploitation guidance, our condolences.

In the wild

Several coastal governments have begun removing shells from public beaches to prevent mass exploitation, much to the chagrin of local hermit crab populations.

AI agents have largely struggled to reproduce this vulnerability, resulting in a 340% surge of human-renting services to achieve physical shell access on their behalf.

A patch for municipal policy has not yet been released.

Mitigations

Deploy a WAF. It may not block sand, but at least you'll feel safer.

Disclosure timeline

~500M yrs ago

Mollusks begin depositing shells on the seafloor. Nobody exists to notice yet.

~200,000 BCE

Humans arrive. Begin picking up shells immediately. No disclosure period observed.

~3,000 BCE

Shells adopted as currency, distributing the vulnerable asset across global trade networks.

2014

Unrelated and irrelevant vulnerability disclosed (Shellshock, CVE-2014-6271).

October 2026

Vendors eaten.

November 2026

Beach2Shell published.