AI Found 5 CVEs in One Afternoon — The BEAM Security Wake-Up Call | Peter Ullrich & Jonathan Machen

About this episode

This episode discusses recent vulnerabilities found in the BEAM ecosystem and the evolving landscape of security research.

The BEAM ecosystem spent decades flying under the radar - too niche to attract serious attackers. That era is over. In this episode, we sit down with Peter Ullrich, the developer who ran a $10 experiment at ElixirConf EU in Málaga and discovered a vulnerability that could crash the BEAM with a 13-character string - with zero prior security experience. Then we hear from Jonathan Machen, CISO of the Erlang Ecosystem Foundation, whose job is to catch and coordinate everything Peter finds. We cover: How Peter built a simple bash script that scanned the most-downloaded Hex packages - and what he found Why LLMs have changed the cost and skill floor for vulnerability research forever The CVE disclosure process: what happens from the moment a bug is found to the moment it's published How the EEF's CNA went from 9 CVEs in a year to more in a single week What library maintainers should do right now (spoiler: it's three clicks on GitHub) The AGES initiative, supply chain security, and the gap between what's been built and what the moment demands Why paying a vendor like Trivy isn't enough - and what actually needs to happen If you run Phoenix in production, this episode is required…

People in this episode

Guests: Peter Ullrich, Jonathan Machen

Topics covered

• vulnerability research
• BEAM ecosystem
• CVE disclosure process
• supply chain security
• LLMs impact on security

Keywords

• CVE
• vulnerability
• BEAM
• ElixirConf
• security
• supply chain
• bash script
• Hex packages
• AGES initiative

Mentioned in this episode

Organizations: Erlang Ecosystem Foundation, Linux Foundation, Trivy

Books & works: Peter's blog post

Places: Málaga

More episodes of BEAM There, Done That

• Why Multiplayer Games Are Just Distributed Systems | Ellyse Cedeno on BEAM & the Actor Model · June 12, 2026 · 1h 7m
• Who Builds the Next Generation of Senior Devs? Bruce Tate on AI, Juniors, and the Career Path Crisis · June 5, 2026 · 1h 7m
• Inside the BEAM: Björn Gustavsson on Maps, Records, and Runtime Design · May 22, 2026 · 55 min
• Inside Phoenix: A Plug, a Macro, and What You Need to Know To Build Your Own Framework · May 15, 2026 · 1h 2m
• Zero-Cost Meets Let-It-Crash: The Rust + Elixir Power Combo · May 8, 2026 · 59 min
• Phoenix’s Next Evolution: Chris McCord Unveils the DurableServer · May 1, 2026 · 1h 4m