29 Jul 2026 · Josh Price

elixir-lang.org has a new look

elixir-lang.org has had its first major redesign in years: a cleaner, more modern homepage that leads with what people build on the BEAM, real companies and use cases up front, plus refreshed branding and easier paths into the docs.

There's no blog post announcing it (the site itself is the announcement), but José Valim filled in the story in the Hacker News thread, which racked up 250+ points: the design is by the Software Mansion folks, iterated on together in Figma, and José rewrote all of the copy himself with feedback from the core maintainers. The thread's reception says a lot about where Elixir sits in 2026: less "what is this language?" and more appreciation for a mature ecosystem that keeps investing in its front door.

If you want the community hot takes, the first episode of the new Macro Mayhem podcast spends a chunk of its news segment on the redesign.

29 Jul 2026 · Josh Price

Macro Mayhem picks up where Thinking Elixir left off

When the Thinking Elixir podcast wrapped up in June after six years of weekly episodes, it left a real hole: it was the way a lot of us kept up with Elixir news on the commute.

Enter Macro Mayhem, a new podcast from Peter Ullrich and Gus Workman covering the latest Elixir news and broader software industry topics. Episode 001, "Redesigns, Conferences, and Rogue Agents", landed on 27 July and sets the template: Hex 2.5.0's new vulnerability warnings, the elixir-lang.org redesign, the conference season ahead (Goatmire with AshConf, ElixirConf US, Code BEAM EU), and a discussion segment on AI news of the week.

Subscribe on Apple Podcasts or Spotify, or grab the feed from macromayhem.fm. And thanks to the Thinking Elixir crew for six great years.

29 Jul 2026 · Josh Price

New OTP CVE batch: patch to 29.0.4, 28.5.0.4 or 27.3.4.15

Two weeks after July's big round-up, the Erlang Ecosystem Foundation CNA has published another batch: eight Erlang/OTP CVEs on 27 July and two for Cowboy/Cowlib on the 28th. The headline is a critical TLS client authentication bypass in ssl. If your app makes TLS connections (and it does), update OTP.

Erlang/OTP

• CVE-2026-55953 CRITICAL 9.1: the TLS 1.2 (and earlier) and DTLS client accepts a cipher suite the server selected even if the client never offered it, enabling an algorithm downgrade and adversary-in-the-middle against ssl clients.

• CVE-2026-58227 HIGH 8.7: TLS/DTLS denial of service via unbounded recursion on a cross-signed peer certificate chain.

• CVE-2026-59251 HIGH 8.7: public_key DoS via exponential certificate-policy-tree growth during path validation.

• CVE-2026-59250 HIGH 8.3: Megaco flex scanner buffer overflow via an oversized property parm name.

• CVE-2026-54890 HIGH 8.2: BEAM VM crash via an integer underflow in binary_to_term BIT_BINARY_EXT decoding, a DoS anywhere you decode untrusted external term format.

• CVE-2026-42792 MEDIUM 6.3: epmd permanent DoS via file-descriptor exhaustion (EMFILE) on accept(2).

• CVE-2026-55737 MEDIUM 5.1: heap pointer corruption via a signed/unsigned mismatch in LARGE_TUPLE_EXT decoding.

• CVE-2026-47078 MEDIUM 4.8: relative path traversal in zip:unzip/1 and zip:extract/1 via a depth-counter bypass in check_dir_level.

  Fix Upgrade Erlang/OTP to 29.0.4, 28.5.0.4, or 27.3.4.15. Same drill as two weeks ago: an OTP upgrade, not a Hex bump.

cowlib

• CVE-2026-59248 HIGH 8.7: unbounded HPACK/QPACK prefixed-integer decoding, a memory-exhaustion DoS reachable through HTTP/2 and HTTP/3.

  Fix Upgrade cowlib to 2.19.0.

cowboy

• CVE-2026-65624 MEDIUM 6.9: duplicate header names bypass the HTTP/1.1 max_headers limit, enabling memory exhaustion.

  Fix Upgrade cowboy to 2.18.0. Newer Phoenix apps default to Bandit, but plenty of deployed apps still serve on Cowboy, so check your lockfile.

What to do

1. Update OTP first: the critical ssl cipher-suite bypass undermines TLS server authentication for every outbound connection your node makes.
2. Run mix hex.audit for the Cowboy/Cowlib pair, and remember Hex 2.5 flags advisories during mix deps.get (see the Hex 2.5 write-up).
3. Watch the EEF CNA advisory list. At this cadence it's worth a bookmark.

The pattern from the last batch holds: mostly DoS via unbounded resource use, but the one that isn't (the TLS downgrade) is the one to lose sleep over. Patch that today.