Beach2Shell

What is Beach2Shell?

Beaches are unauthenticated, publicly accessible distribution points for shells. The attacker walks to the endpoint, bends at the waist, and picks one up, gaining immediate arbitrary command execution.

This exploit has gone largely undetected for roughly 200,000 years. The earliest known threat actors are toddlers, who achieve reliable shell access with minimal security experience, and Redditors.

Indicators of compromise

If you notice an excited child in your environment approaching with cupped hands, assume compromise. Immediately terminate the child process and pray the shell is dropped. Other IoCs may include tan lines or sandy hair.

Scoring

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

The ocean is, by definition, a network. It has connected every continent for the last 200 million years. It delivers shells to 150+ countries simultaneously, on a predictable six-hour tide cycle, with no rate limiting. It predates TCP by a few years, per our estimates.

Conventional analysts score this as Physical because the attacker has to be present, but who cares what they have to say, anyway?

Exploitation

If you require exploitation guidance, you have our condolences.

In the wild

Several coastal governments have begun removing shells from public beaches to prevent mass exploitation, much to the chagrin of local hermit crab populations.

AI agents have largely struggled to reproduce this vulnerability, resulting in a 340% surge of human-renting services to achieve physical shell access on their behalf.

A patch for municipal policy has not yet been released.

Mitigations

Deploy a WAF. It may not block sand, but at least you'll feel safer.

Disclosure timeline

~540M yrs ago

Mollusks begin depositing shells on the seafloor. Nobody exists to notice yet.

~300,000 yrs ago

Humans arrive. Begin picking up shells immediately. No disclosure period observed.

~1600 BCE

Shang China adopts cowries as money. The vulnerable asset enters the economy.

September 2026

Vendors notified.

October 2026

Vendors eaten.

November 2026

Beach2Shell published.