2 Shell 2 Furious

The original granddaddy of the shell-named vulnerabilities, Shellshock landed in 2014 with, well, a shock.

It doesn't follow the naming pattern quite as closely, but I include it here for origin points.

Log4Shell was a remote code execution vulnerability in Apache Log4j 2, but more importantly, it's where we first see this naming pattern show up. It was so dramatic, so vast in scope that it left its mark on vulnerability disclosures forever more.

These were still early days, though: there's no marketing website for the bug!

More marketing SEO than buzzword, "Spring4Shell" is the name UpGuard gave to an RCE risk in the Spring Core Java framework.

This, much like Spring4Shell before it, is a marketing name for an otherwise calmly reported arbitrary code execution path in Apache Commons Text. The researcher didn't even try to put out a snazzy website and press release!

This is the first time the vulnerability came with its own website, and uses the <tech>#shell formulation.

The website is nice, simple, and clear.

wp2shell was so named by the research team that posted it. Snappy name, but the url doesn't pop.

Better luck next time, folks!

Another case of a security advisory marketing firm slapping a "2shell" label on a oerfectly reasonable high impact security issue.

Now that we've reached the Age of AI security "research", I expect these will become more common, since the name is in "in the training set". At least this one was named by the research bot that found it.

The website's still got a lame URL though.

Hey, now the coding agents are getting in on it, too!.

Zero-click RCE sounds bad, right? Not as bad as the lame URL.

Points to the research team that named this for the "Ah shit, here we go again." GTA reference.

I wonder if the theme of agent-using companies sticking to this repetitive name pattern will continue?

This one is named in the proof of concept; WordPress itself doesn't deign to name it.

They also have a nifty logo!

Not content to let WordPress have all the fun, Plex got into the action with plex2shell, but again, no snazzy website.

This is around the point where it started to feel repetitive, ya know? There is a snappy domain for it, crediting our new robotic exploitation machines with the work.

In any other industry, this one would be a joke. Still, there's a website with the pithy name, and the risk is real enough.