Semgrep(@semgrep):Following the Node2Shell and PHP2Shell incidents, we shipped a workflow to detect which repos may be affected: Detect-2Shell How it works: It finds where the Node or PHP version is listed in Docker image tags, .nvmrc files, IaC, and CI setup steps. First, it finds version references in Python, it checks out whether that version is 🔴 vulnerable, 🟠 unpinned, 🟢 fixed, or ⚪ unknown. Then, it uses AI to look deeper, in places where the version is inside a variable, bundled image, or built from source. The results show where there is risk and guidance for how to fix it. Detect-2Shell is now available for customers with Workflows enabled.

2026.10.26 18:05

Following the Node2Shell and PHP2Shell incidents, we shipped a workflow to detect which repos may be affected: Detect-2Shell How it works: It finds where the Node or PHP version is listed in Docker image tags, .nvmrc files, IaC, and CI setup steps. First, it finds version references in Python, it checks out whether that version is 🔴 vulnerable, 🟠 unpinned, 🟢 fixed, or ⚪ unknown. Then, it uses AI to look deeper, in places where the version is inside a variable, bundled image, or built from source. The results show where there is risk and guidance for how to fix it. Detect-2Shell is now available for customers with Workflows enabled.