Peter Ullrich on Hunting CVEs

About this episode

Peter Ullrich discusses his CVE hunting efforts and the implications of software vulnerabilities.

Peter Ullrich returns to talk about a CVE hunt across the most-downloaded Hex packages, run with Claude Code on Opus 4.7. After ElixirConf EU pulled him into AI security, he started pointing Opus at popular libraries day and night, and within half an hour of his first serious attempt he found the Decimal vulnerability, where raising 10 to a huge power can blow up an application's memory. We get into what separates a real CVE from noise, how CVSS scoring works, and why reachability matters so much, since a flaw in Phoenix's default configuration is far more serious than a crash in a function nobody can call. Peter also walks through the process he runs with the EEF: verifying each issue, getting a second pair of eyes, coordinating a fix, and getting a number issued through a CNA, all while avoiding slop reports to maintainers. There's also a candid stretch on regulation and breach reporting. From there it widens out, including how Opus compares to Mythos, why Peter keeps coming back to Claude, his first impressions of Opus 4.8, and the economics, with a simple scan costing about $10 in API tokens. He also shares his Session Watcher plugin, an update on Killswitch and its…

People in this episode

Host: Jacob Luetzow

Guest: Peter Ullrich

Topics covered

• CVE hunting
• AI security
• Hex packages
• vulnerability assessment
• software security
• regulation
• breach reporting

Keywords

• CVE
• Hex packages
• vulnerability
• AI security
• Decimal
• Opus
• Phoenix
• software security
• regulation
• breach reporting

Mentioned in this episode

Organizations: Phoenix, EEF, CNA, AEO, Scrutineer

Products: Opus 4.7, Decimal, Opus 4.8, Session Watcher, Killswitch

Books & works: what-the-cve

More episodes of Elixir Mentor

• Tjaco Oostdijk on Drums to Elixir · June 7, 2026 · 1h 31m
• Jason Allum on Bedrock · May 24, 2026 · 1h 35m
• Michael Lubas on AI, Attack, and Defense · May 16, 2026 · 1h 32m
• Vasilis Spilka on LLMs & Ash · April 21, 2026 · 1h 37m
• Luca Corti on Bringing Elixir to Fintech · April 12, 2026 · 1h 40m
• Steve Domino on Starting a Fintech · April 4, 2026 · 1h 35m