There's no blog post announcing it (the site itself is the announcement), but José Valim filled in the story in the Hacker News thread, which racked up 250+ points: the design is by the Software Mansion folks, iterated on together in Figma, and José rewrote all of the copy himself with feedback from the core maintainers. The thread's reception says a lot about where Elixir sits in 2026: less "what is this language?" and more appreciation for a mature ecosystem that keeps investing in its front door.

If you want the community hot takes, the first episode of the new Macro Mayhem podcast spends a chunk of its news segment on the redesign.

Enter Macro Mayhem, a new podcast from Peter Ullrich and Gus Workman covering the latest Elixir news and broader software industry topics. Episode 001, "Redesigns, Conferences, and Rogue Agents", landed on 27 July and sets the template: Hex 2.5.0's new vulnerability warnings, the elixir-lang.org redesign, the conference season ahead (Goatmire with AshConf, ElixirConf US, Code BEAM EU), and a discussion segment on AI news of the week.

Subscribe on Apple Podcasts or Spotify, or grab the feed from macromayhem.fm. And thanks to the Thinking Elixir crew for six great years.

Erlang/OTP

• CVE-2026-55953 CRITICAL 9.1: the TLS 1.2 (and earlier) and DTLS client accepts a cipher suite the server selected even if the client never offered it, enabling an algorithm downgrade and adversary-in-the-middle against ssl clients.

• CVE-2026-58227 HIGH 8.7: TLS/DTLS denial of service via unbounded recursion on a cross-signed peer certificate chain.

• CVE-2026-59251 HIGH 8.7: public_key DoS via exponential certificate-policy-tree growth during path validation.

• CVE-2026-59250 HIGH 8.3: Megaco flex scanner buffer overflow via an oversized property parm name.

• CVE-2026-54890 HIGH 8.2: BEAM VM crash via an integer underflow in binary_to_term BIT_BINARY_EXT decoding, a DoS anywhere you decode untrusted external term format.

• CVE-2026-42792 MEDIUM 6.3: epmd permanent DoS via file-descriptor exhaustion (EMFILE) on accept(2).

• CVE-2026-55737 MEDIUM 5.1: heap pointer corruption via a signed/unsigned mismatch in LARGE_TUPLE_EXT decoding.

• CVE-2026-47078 MEDIUM 4.8: relative path traversal in zip:unzip/1 and zip:extract/1 via a depth-counter bypass in check_dir_level.

  Fix Upgrade Erlang/OTP to 29.0.4, 28.5.0.4, or 27.3.4.15. Same drill as two weeks ago: an OTP upgrade, not a Hex bump.

cowlib

• CVE-2026-59248 HIGH 8.7: unbounded HPACK/QPACK prefixed-integer decoding, a memory-exhaustion DoS reachable through HTTP/2 and HTTP/3.

  Fix Upgrade cowlib to 2.19.0.

cowboy

• CVE-2026-65624 MEDIUM 6.9: duplicate header names bypass the HTTP/1.1 max_headers limit, enabling memory exhaustion.

  Fix Upgrade cowboy to 2.18.0. Newer Phoenix apps default to Bandit, but plenty of deployed apps still serve on Cowboy, so check your lockfile.

What to do

1. Update OTP first: the critical ssl cipher-suite bypass undermines TLS server authentication for every outbound connection your node makes.
2. Run mix hex.audit for the Cowboy/Cowlib pair, and remember Hex 2.5 flags advisories during mix deps.get (see the Hex 2.5 write-up).
3. Watch the EEF CNA advisory list. At this cadence it's worth a bookmark.

The pattern from the last batch holds: mostly DoS via unbounded resource use, but the one that isn't (the TLS downgrade) is the one to lose sleep over. Patch that today.

Got a talk in you? We're after speakers, full-length or lightning, and first-timers are very welcome. Pitch us a talk.

Got a talk in you? We're after speakers, full-length or lightning, and first-timers are very welcome. Pitch us a talk.

ueberauth_apple

• CVE-2026-55954 CRITICAL 9.1: the JWT signature is checked but ID-token claims aren't, so any Apple-signed token bearing a victim's identifier can be replayed for account takeover.

  Fix Upgrade ueberauth_apple to 0.6.2. Patch this today if you offer Sign in with Apple.

phoenix

• CVE-2026-56811 HIGH 8.7: no per-connection channel-join limit, process-exhaustion DoS from a single unauthenticated connection.

• CVE-2026-56812 MEDIUM 6.3: Presence client crashes on prototype-key collisions in syncState/syncDiff.

  Fix Upgrade phoenix to 1.8.9 (or 1.7.24 / 1.6.17 / 1.5.15 on older branches).

mint

• CVE-2026-56810 HIGH 8.7: buffers an entire chunked response chunk in memory.

• CVE-2026-58229 HIGH 8.2: unbounded HTTP/1 response-header accumulation, memory-exhaustion DoS.

• CVE-2026-59246 MEDIUM 6.3: zero-length HTTP/2 CONTINUATION frames slip past the header byte-size cap.

  Fix Upgrade mint to 1.9.2. Mint sits under Finch, Req and friends, so you may pull it in transitively.

hpax

• CVE-2026-58226 HIGH 8.7: unbounded HPACK integer decoding, unauthenticated DoS.

  Fix Upgrade hpax to 1.0.4. Transitive via Bandit and Mint.

ssl (Erlang/OTP)

• CVE-2026-55950 HIGH 8.7: DTLS listener crash via a race in dtls_packet_demux.

• CVE-2026-55952 HIGH 8.2: TLS 1.3 server DoS via a malformed ClientHello pre-shared-key extension.

• CVE-2026-54891 MEDIUM 6.3: plaintext APPLICATION_DATA injected during the TLS handshake, delivered post-handshake.

• CVE-2026-54887 MEDIUM 6.3: DTLS cookie bypass during the startup window.

  Fix Upgrade Erlang/OTP to 29.0.3, 28.5.0.3, or 27.3.4.14 (whichever matches your branch). An OTP upgrade, not a Hex bump.

mdex

• CVE-2026-53426 HIGH: atom-table exhaustion DoS via JSON parse_document.

• CVE-2026-54889 MEDIUM: javascript: injection (XSS) in Quill Delta output.

• CVE-2026-54888 MEDIUM: uncontrolled recursion over deeply nested Markdown crashes the BEAM.

• CVE-2026-53429 MEDIUM: native memory leak in escaped-tag rendering.

• CVE-2026-53428 MEDIUM: unbounded allocation in highlight_lines range expansion.

• CVE-2026-53427 LOW: XSS via an unescaped highlight_lines_class code-fence attribute.

  Fix Upgrade mdex to 0.13.x (we run 0.13.3). We hit these on this very site, see the Hex 2.5 write-up.

plug

• CVE-2026-56814 MEDIUM 6.9: multipart part headers aren't charged to the :length limit, so uploads can create unbounded temp files.

• CVE-2026-56813 LOW 2.1: cookie attribute injection in Plug.Conn.Cookies.encode/2.

  Fix Upgrade plug to 1.20.3 (or 1.19.5 / 1.18.5 / 1.17.4 / 1.16.6 on older branches).

ssh (Erlang/OTP)

• CVE-2026-54886 MEDIUM 5.3: SFTP server DoS via an extended channel-data infinite loop.

• CVE-2026-53422 LOW 2.3: SFTP REALPATH path-existence oracle allows enumeration outside the configured root.

  Fix The same OTP releases as above: 29.0.3 / 28.5.0.3 / 27.3.4.14.

phoenix_live_view

• CVE-2026-58228 MEDIUM 5.1: scheme-validation bypass in Phoenix.LiveView.Utils, XSS via <.link>.

  Fix Upgrade phoenix_live_view to 1.2.7.

postgrex

• CVE-2026-58225 LOW 2.1: SQL injection via an unescaped dollar-quote in notification reconnect replay, causing DoS.

  Fix Upgrade postgrex to 0.22.3.

swoosh

• CVE-2026-54893 LOW 2.1: email-derived URL path injection in the Microsoft Graph adapter, only if you derive the sender address from untrusted input.

  Fix Upgrade swoosh to 1.26.3.

What to do

1. Run mix hex.audit. On Hex 2.5 it also flags advisories inline during mix deps.get and fails CI on a vulnerable lockfile (see the Hex 2.5 write-up).
2. Patch worst first: the CRITICAL ueberauth_apple account-takeover, then the HIGH memory-exhaustion DoS in Phoenix, Mint, hpax and OTP ssl. Update Erlang/OTP for the ssl and ssh ones.
3. Watch the EEF CNA advisory list.

Most of these are denial-of-service via unbounded memory, but the Apple auth bypass is a real account takeover and the LiveView issue is an XSS, so don't sit on those. The reassuring part: the ecosystem catalogues this properly now and the tooling surfaces it, so staying current is mostly a matter of running the audit and not ignoring it.

There's a nice symmetry to it: Kip gave a talk at Elixir Sydney in May 2024, Fast and efficient image processing in Elixir, on exactly this topic, using libvips, Vix and Image to scale, transform and compose images fast. We're now running his library to build the very page you're reading.

What it does for us

• A mix images build step walks the image folder and writes a right-sized .webp next to each source (avatars capped at 160px, event photos at 800px). On-page images dropped from roughly 5 MB to about 900 KB.
• The OpenGraph share cards are re-encoded to lossless WebP through the same library (libvips' webpsave), taking the card set from around 26 MB to 9 MB with no loss of crispness on the text.
• It's self-contained: Vix ships a precompiled libvips, so there's nothing to install in CI.

Image is a lovely piece of the ecosystem: a clean Elixir API over a very fast C library, precompiled so it just works. If you push images around in an Elixir app, watch Kip's talk and reach for Image.

If your company runs Elixir, Erlang, Gleam or anything else on the BEAM, we'd love to include you. There are two other places worth getting listed, both a quick way to show your support for the ecosystem:

• The EEF company registry, where companies formally register their use of the ecosystem so the Erlang Ecosystem Foundation can point to who depends on it.

• elixir-companies.com, the community directory. Adding yourself is a pull request on the repo.

Getting on these lists helps people find BEAM work locally and makes the community a little more visible. Tell us at a meetup or drop us a line and we'll add you to the Sydney list too.

Advisories in the terminal

mix deps.get and mix deps.update now flag known-vulnerable packages inline, tagging them "VULNERABLE" with a short summary and deduplicating advisories across databases. It is exactly how we recently caught and cleared a handful of advisories on this very site. Resolving deps looks like this now:

Resolving Hex dependencies...
Resolution completed in 0.42s
  mdex 0.11.7 VULNERABLE!
    EEF-CVE-2026-54889 (MEDIUM)
    aka: CVE-2026-54889, GHSA-4383-7xfp-gpph
    Unsanitized URL schemes in MDEx Quill Delta output allow javascript: injection (XSS)
    https://osv.dev/vulnerability/EEF-CVE-2026-54889
    EEF-CVE-2026-53426 (HIGH)
    aka: CVE-2026-53426, GHSA-923r-7vf4-5vw8
    Atom-table exhaustion denial-of-service via JSON parse_document in MDEx
    https://osv.dev/vulnerability/EEF-CVE-2026-53426
Found packages with security advisories

For CI, mix hex.audit inspects your lockfile and exits non-zero if any dependency carries an advisory or has been retired, so a vulnerable release fails the build instead of slipping through:

$ mix hex.audit
Advisories:
  phoenix_live_view 1.2.6 - EEF-CVE-2026-58228 (MEDIUM)
    aka: CVE-2026-58228, GHSA-5cgh-g58j-m9cq
    Scheme validation bypass in Phoenix.LiveView.Utils leads to XSS via <.link>
    https://osv.dev/vulnerability/EEF-CVE-2026-58228

Found packages with security advisories

Bumping phoenix_live_view to a patched release and re-running it prints "No retired or security advisory packages found", and the build is green again. This is all on for every project with nothing to configure.

Release-age cooldown

The cooldown withholds very recently published versions from resolution, giving the community time to catch a bad release before it lands in your deps:

# mix.exs
hex: [cooldown: "7d"]

Durations look like 7d, 2w or 1mo. It never touches already-locked dependencies, and there is an escape hatch when a current version turns out to be unsafe. mix hex.outdated shows which updates are being held and when they become eligible.

Dependency policies

Organisations can publish a signed policy and enforce it across every project that opts in, restricting releases by advisory severity, retirement reason, or release age. mix hex.policy show summarises the active policy, and mix hex.policy why <package> explains, version by version, why something is blocked.

Package authors need do nothing for any of this. Consumers get the advisories and the cooldown for free, which is a rare thing in security: a genuine improvement you pick up just by upgrading.

The advisories Hex surfaces are published by the Erlang Ecosystem Foundation CNA, which has been busy lately. Watch it, run mix hex.audit, and keep your dependencies current: most of these fixes are one mix deps.update away. We rounded up the last month's advisories here.

We'll kick off with an ecosystem update covering the Mythos class Fable 5 launch and what's been happening in the community in 2026, including security updates and new releases, followed by two Ash framework talks.

Thanks to Decidr for hosting us in the CBD. RSVP on Luma to see the venue address.

Got an idea for a talk? Submit a talk proposal or come along and say hi, everyone is welcome, no matter your skill level.

The new site is a small, fast static site built, fittingly, in Elixir with Tableau, the elixir-tools static site generator. The whole thing compiles to plain HTML and is pushed to S3 and served through CloudFront, so it's cheap, fast and has nothing to keep running. Content lives as Markdown and YAML in the repo, and every push to main deploys automatically.

More importantly, it now documents every Elixir Sydney meetup since 2015: more than eighty events and the talks, speakers and recordings that went with them. A lot of that had been scattered across an old site, our Meetup group, GitHub and the Internet Archive, and we've pulled it back together for good.

We've also finally shut down our Meetup.com group (yay!). It served us well for a decade, but it's done, everything now lives here, with RSVPs on Luma.

A few things to explore:

• Events, the full archive, newest first, with talk videos and slides where we have them.
• Speakers, everyone who has ever given a talk, with links to their work. If you spot something wrong, let us know.
• Give a talk, first-time speakers are very welcome, and we're happy to help you shape an idea.

RSVPs now run through Luma, and we hang out in the Elixir community channels linked in the footer.

See you at the next one.

On 9 June, Anthropic released Claude Fable 5 and Mythos 5, pitching Fable 5 as its most capable widely-released model and aiming it squarely at long-horizon agentic work. It went out the same day across the Claude API, AWS Bedrock, Microsoft Foundry and the rest.

Then on Friday 12 June, the US Commerce Department directed Anthropic to block foreign nationals from using both models. Rather than carve the world in two, Anthropic disabled Fable 5 and Mythos 5 globally for everyone the same day. As best anyone can tell, the government believes a way to jailbreak Fable 5 surfaced, and the standoff traces back to Anthropic refusing to hand over full access to Claude.

Worth noting from down here: "foreign nationals" includes us. So even setting the jailbreak drama aside, a Sydney developer poking at Fable 5 over the weekend would have watched it blink out regardless.

It's a strange one to sit with. The most capable model anyone had shipped, public on a Tuesday and pulled by Friday, on government order. If you're building agentic tooling on the BEAM, it's a sharp reminder that the model under your abstraction can disappear out from under you. Plan for the provider, and the politics, not just the API.

The headline is colocated CSS. Where 1.1 let you keep a component's hooks and JS next to its markup, 1.2 lets you do the same with styles, using the CSS @scope rule to stop them leaking into the rest of the page. To make that work the team had to split HEEx compilation into separate tokenization and parsing steps, which is the kind of unglamorous internal change that quietly makes a lot of other things possible.

A few other things worth knowing:

• Phoenix.LiveView.JS commands are now automatically encoded when you send them with push_event, whether you're on Jason or the built-in JSON module.
• Test warnings can be configured by category, so you can tune the checks that run in LiveViewTest.
• Custom formatting for <script> and <style> tags, and module-level HEEx debug annotations.

Worth a look if you're building anything with LiveView. We'll likely touch on it at an upcoming meetup, RSVP on Luma.

The wake-up call: CVE-2025-32433

In April 2025, CVE-2025-32433 landed, an unauthenticated, pre-auth remote code execution flaw in Erlang/OTP's SSH server, scored a maximum CVSS 10.0. A remote attacker could run code before authenticating. It was fixed in OTP-27.3.3, 26.2.5.11 and 25.3.2.20, and it was a clear reminder to keep the runtime patched.

OTP 29 responds

That focus shows up directly in OTP 29: SSH is now secure-by-default (shell and exec disabled unless you enable them), TLS defaults to a post-quantum key exchange, and the compiler warns about unsafe functions, alongside a new set of secure coding guidelines.

The EEF is now a CVE Numbering Authority

The bigger structural change: the Erlang Ecosystem Foundation is now a CNA (a CVE Numbering Authority). It assigns CVE IDs and publishes advisories for active Hex.pm packages and the elixir-lang, erlang, erlef and gleam-lang GitHub orgs, with records published at cna.erlef.org. It's already coordinating real disclosures,recent 2026 advisories cover Tesla middleware, public_key certificate validation, and the Mint HTTP/2 client, which means coordinated, properly-tracked vulnerability handling for the whole ecosystem.

What to do

• Keep Elixir and OTP patched, most BEAM CVEs are fixed quickly across supported release lines.
• Watch cna.erlef.org and the EEF security advisories.
• Run mix hex.audit for retired packages, and consider mix_audit (mix deps.audit) to scan deps against known advisories in CI.

Elixir 1.20

Released on 3 June 2026, Elixir 1.20 is a landmark for the type system. The compiler now performs type inference and gradual type checking of every Elixir program, with no type annotations required. In practice that means Elixir increasingly flags dead code and guaranteed-to-fail typing violations, with a very low false-positive rate.

Highlights:

• Type narrowing across guards, case/cond/with clauses, and conditionals (occurrence typing), so types are more precise inside each branch.
• Much of the standard library is now typed, including most of the Map module and tuples.
• Faster compilation, especially on many-core machines, the benchmarks now put Mix among the fastest build tools on the BEAM.

Erlang/OTP 29

OTP 29 (13 May 2026) leans hard into security and developer ergonomics:

• Secure-by-default SSH (shell/exec disabled unless you opt in) and a post-quantum x25519mlkem768 default key exchange for TLS.
• New warnings for unsafe and potentially-unsafe functions, plus secure coding guidelines.
• Experimental native records (EEP-79), multi-valued comprehensions, an is_integer/3 guard, and JIT improvements for binary matching.

If you want to play with both, point your version manager at Elixir 1.20.1 on OTP 29.0.2, that's what runs this very site's build pipeline.

We'll cover the ecosystem updates at the next meetup, RSVP on Luma.

So hexdocs.pm/ecto becomes ecto.hexdocs.pm, and hexdocs.pm/ecto_sql becomes ecto-sql.hexdocs.pm (underscores turn into hyphens). Organisation docs move from org.hexdocs.pm/package to org.hexorgs.pm/package.

The reason is security. Until now every public package was served from the same origin, so a malicious or compromised package could, in principle, reach into another package's docs in the browser. Giving each package its own subdomain hands that isolation to the browser's same-origin policy for free. It's a small, sensible piece of the same security push we wrote about across the ecosystem.

Nothing breaks today, old URLs redirect to the new ones. But if you've got HexDocs links in a README, a blog post, or your socials, it's worth updating them to the subdomain form while you're thinking about it.

Read the announcement on hex.pm.

The pitch is simple. The registry shows the real scope of the ecosystem across more than sixteen languages, helps people find companies working with the tech they know, and gives the Foundation something concrete to point funders at. Signing up is quick: one person nominates themselves as the contact, verifies by email, and the company is listed. There's no further commitment, and registered contacts get a quarterly update on what's happening across the ecosystem.

If your company works with Elixir or the BEAM, add it to the registry. It takes a few minutes and it makes the community look as big as it actually is. We'd especially love to see more Sydney and Australian names on the list.

And if you can do more than a free listing: the EEF runs on membership and sponsorship. The security work we wrote about recently, the working groups, the infrastructure, all of it is funded by companies that rely on the BEAM. If that's you, supporting the EEF is a direct way to give back to the runtime your business is built on.

Agenda

• 5:30pm, Welcome, housekeeping & introduction
• 6:00pm, Talks (with a break in between)

Got an idea for an Elixir talk? We’d love to hear it! Whether you’re an experienced developer with deep insights or just starting out and excited to share what you’ve learned, our meetups are a great place to connect, learn, and grow.

Not ready to give a talk? No worries! Come along to meet fellow Elixir enthusiasts, ask questions, and get guidance from more experienced developers. Everyone is welcome, no matter your skill level!

If you’d like to submit a talk idea, just drop us a message, we’re happy to help you shape it into a great presentation!

Josh and Mike

Whether you're a seasoned developer or just curious about Elixir, come along for an evening filled with engaging discussions, insightful talks, and maybe even a few surprises.

Josh and Mike

Josh and Mike

Josh and Mike

Josh and Mike

Places are limited, so please respond ASAP if you're up for mingling with some fellow Alchemists and José on Wednesday 6th December.

See you there,

Josh and Mike