19 Aug 2026 · Josh Price

Conference season: Goatmire, AshConf and the Alembic crew on tour

The next two months are the busiest stretch of the BEAM calendar, and there's a distinctly antipodean flavour to it this year. The season at a glance:

• ElixirConf US, 10 to 11 September, Chicago and online (a virtual ticket gets you both tracks).
• Goatmire Elixir, 28 September to 3 October, Varberg, Sweden, with AshConf capping it off.
• Code BEAM Europe, 21 to 22 October, Haarlem, Netherlands and online.

Goatmire

Goatmire is the one we keep hearing about: a community-first Elixir gathering in the seaside town of Varberg that optimises for connection over scale. The week runs free community workshops at Campus Varberg on the 28th and 29th, then three conference days at Varbergs Teater, with day one doubling as NervesConf EU. Speakers include Nerves core's Frank Hunleth, Sonic Pi creator Sam Aaron, and Ash creator Zach Daniel among 35+ others.

AshConf, co-presented by Alembic

Saturday 3 October is AshConf, a dedicated one-day Ash Framework conference presented by the Ash project together with Alembic, with talks from Ash core team members, key contributors and expert users. It's free for Erlang Ecosystem Foundation annual supporting members (everyone else is invited to donate to the Ash Open Collective), lunch included. The call for speakers is open on Sessionize, and you can register on Luma.

I'll be there too, talking about precision domain modelling with Ash and Localize (yes, the library Kip showed us this month), and what becomes possible when your domain model has better types. Zach's announcement was far too kind about it.

Familiar faces on the programme

The Goatmire week is thick with people who've stood in front of this meetup:

• Conor Sinclair (tech lead at Alembic) co-leads the free Ash Demystified workshop with Ash core's Barnabas Jovanovics: a ground-level introduction to why developers won't shut up about Ash.
• James Harton (principal engineer at Alembic, Ash core team, author of Reactor and Ash Authentication) is doing double duty: the Beam Bots: Robotics on the BEAM talk with live robot demos, plus the Achieving Balance in the Workshop session where attendees assemble a Nerves-powered balance bot, drive it from a Phoenix app on their phone, and take the robot home.
• Rebecca Le (Alembic, Ash core team, co-author of the Ash book) presents Video Game Archaeology with Elixir: parsing Morrowind's 24-year-old binary format, modelling the game world with Ash and Postgres, and browsing it all in LiveView.

If Sweden is a stretch, the ElixirConf US virtual ticket is the easy way to get a conference fix from this timezone, and Code BEAM Europe streams online too. Closer to home, we'll see you at the September Hack Night.

19 Aug 2026 · Josh Price

August BEAM security advisories: Livebook, Guardian, Ash and more

Three weeks on from the July round-up and the OTP batch, the Erlang Ecosystem Foundation CNA has published another 25 CVEs. Nothing CRITICAL this time, but plenty of HIGHs, and two packages where the obvious patch version doesn't cover everything, so read the Fix lines carefully. As always: grouped by package, ordered by severity (CVSS), worst first, and if you do one thing, run mix hex.audit.

absinthe_federation

• CVE-2026-67585 HIGH 8.7: unauthenticated GraphQL _entities requests with crafted keys hit String.to_atom/1, exhausting the atom table and crashing the VM.

  Fix Upgrade absinthe_federation to 0.9.3.

Livebook

• CVE-2026-66298 HIGH 8.6: untrusted notebook JS can synthesize keyboard events from the sandboxed iframe to trigger session shortcuts, forcing cell evaluation or a runtime restart.

• CVE-2026-68746 HIGH 7.7: Teams identity enforcement fails open when a deployment group can't be resolved, granting unauthenticated access.

• CVE-2026-66881 HIGH 7.0: relative path traversal in file entry imports lets a malicious notebook write files anywhere the Livebook process can.

• CVE-2026-66885 MEDIUM 6.8: login CSRF, missing OAuth state/nonce validation in Teams sign-in.

• CVE-2026-66297 MEDIUM 5.0: env var values interpolated unescaped into generated Docker/Fly.io deployment commands, so $(...) substitution runs.

  Fix Upgrade Livebook to 0.19.9 (or 0.18.7 on the older branch). One upgrade covers all five.

html_sanitize_ex

• CVE-2026-68749 HIGH 8.2: CPU-exhaustion DoS via unbounded greedy regex in the CSS scrubber, around 2.4s of CPU per 80KB style body.

• CVE-2026-68750 HIGH 8.2: quadratic sibling traversal, 20k siblings holds a scheduler for about 1.7s.

• CVE-2026-66370 MEDIUM 4.8: the html5 scrubber keeps form/formaction attributes, so injected inputs can redirect submissions of an existing form.

• CVE-2026-68747 LOW 2.3: CSS allowlist bypass, at-rules like @import url(//attacker/style.css) survive sanitisation.

• CVE-2026-66829 LOW 2.3: <meta http-equiv="refresh"> is retained, an open redirect.

• CVE-2026-66843 LOW 2.3: <object data=...> URI validation only checks a lowercase javascript: prefix.

  Fix Upgrade html_sanitize_ex to 1.5.4. Gotcha: 1.5.3 fixes five of the six but not the @import bypass, so don't stop there.

guardian

• CVE-2026-55735 HIGH 8.2: Guardian.revoke/3 decodes tokens without verifying the signature, so an unauthenticated attacker with a forged JWT can revoke victims' sessions.

• CVE-2026-55733 MEDIUM 6.9: atom exhaustion in Guardian.Permissions.AtomEncoding on untrusted input.

• CVE-2026-55734 MEDIUM 6.9: atom exhaustion via untrusted permission map keys.

• CVE-2026-54894 MEDIUM 6.9: atom exhaustion in Guardian.Plug.Keys when key names come from attacker-influenced input like tenant IDs.

  Fix Upgrade guardian to 2.4.1. One bump covers all four.

ash

• CVE-2026-67579 HIGH 7.5: filter expression injection via forged keyset pagination cursors. Deserialised %Ash.Query.Call{} structs bypass the safety gates, which means SQL injection on AshPostgres or in-process code execution on the ETS/Simple data layers.

• CVE-2026-69659 MEDIUM 5.9: keyset cursors accept zlib-compressed binary_to_term payloads with no size cap, kilobytes in, tens of megabytes out.

• CVE-2026-70395 LOW 2.1: predicate injection in manage_relationship belongs_to lookups can leak secret lookup keys.

  Fix Upgrade ash to 3.31.3. Gotcha: 3.31.1 fixed the two lower ones but not the HIGH filter injection, which landed three days later. Go straight to 3.31.3.

oidcc_plug

• CVE-2026-66883 MEDIUM 6.3: a case-sensitive "User-Agent" header lookup silently disables session user-agent binding even with check_useragent: true.

• CVE-2026-66884 LOW 2.1: the authorization callback accepts callbacks missing session state, a CSRF enabling forced login.

  Fix Upgrade oidcc_plug to 0.5.0.

cowlib

• CVE-2026-43971 MEDIUM 6.3: cow_link:link/1 interpolates unescaped > in target URIs and "/\ in rel values, letting attackers smuggle arbitrary Link header entries.

  Fix No tagged release at time of writing; the fix is commit 89da27e. If you build Link headers from user input, sanitise it (reject > in targets and quotes/backslashes in rel values) and watch for the next cowlib release.

postgrex

• CVE-2026-66838 MEDIUM 5.9: SQL injection via the :comment option of Postgrex.stream/4, where a */ closes the comment block early. Only stream/4 skips the comment validation.

  Fix Upgrade postgrex to 0.22.4.

oaskit

• CVE-2026-66296 MEDIUM 5.1: reflected XSS, the default HTML error handler interpolates request-controlled values unescaped.

  Fix Upgrade oaskit to 0.14.1, or set html_errors: false.

phoenix_live_view

• CVE-2026-64941 LOW 2.1: open redirect, validate_local_url!/2 didn't strip the ASCII tab/newline characters browsers ignore when parsing URLs.

  Fix Upgrade phoenix_live_view to 1.2.9 (or 1.1.33 / 1.0.19 on older branches). Yes, again; we bumped this site's lockfile too.

What to do

1. Run mix hex.audit, and let Hex 2.5 fail CI on a vulnerable lockfile (see the Hex 2.5 write-up).
2. Patch worst first: the Guardian revoke/3 signature bypass and the Livebook trio if you run either, then the DoS pile.
3. Mind the two version gotchas: html_sanitize_ex needs 1.5.4 (not 1.5.3) and ash needs 3.31.3 (not 3.31.1).
4. Watch the EEF CNA advisory list.

The theme this month is untrusted input reaching places that assume trust: atoms, filters, cursors, sanitisers. Nothing here is a remote takeover of a patched stack, but the Guardian and Ash ones are genuinely nasty in the wrong app shape, so run the audit today rather than at the next meetup.

19 Aug 2026 · Josh Price

September is Hack Night at Decidr

Our September meetup is a Hack Night: Wednesday 16 September, 5:30 PM at Decidr in the Sydney CBD. No talks, no schedule, just a room full of BEAM people, their laptops and their pet projects. Bring your ideas, your projects and your laptop, and be ready to code.

It's a great excuse to finally start that thing, and an even better one to watch how other people work: plenty of us will be pairing on Elixir and comparing AI-assisted coding workflows on real code. If you're new to Elixir or just curious, this is honestly the best possible first meetup. There's no pressure to know anything yet, and you'll have experienced folks at the table to pair with and get you unstuck.

One thing to note: unlike our usual meetups, this one is in person only, with no livestream. RSVP on Luma to see the venue address and entry instructions, and we'll see you on the 16th.

18 Aug 2026 · Josh Price

Ecosystem roundup: Macro Mayhem Podcast

Macro Mayhem, the podcast that picked up where Thinking Elixir left off, is three episodes in and showing no signs of slowing down. Episode 003 landed this week, and it surfaced enough good ecosystem news that it deserves a written round-up of its own.

Phoenix and Bandit, by the numbers

Praia Labs published two posts putting actual numbers on things we usually only have vibes for. Their Phoenix version adoption analysis of Hex download data has Phoenix 1.8.x at roughly 64% of monthly downloads by mid-2026 (it crossed the 50% line back in March), with 1.7.x still above 28%. The companion Bandit adoption post is the fun one: Bandit reached download parity with Cowboy in July, up from about 2% in late 2023, with the big jump coming when it became the Phoenix default. Bandit users also patch faster: 38% were on a new security release within three days, versus 28% for Cowboy. The usual caveat applies, downloads are a proxy rather than a census, but the trend lines are hard to argue with.

Sobelow 0.15

The Phoenix security scanner Sobelow shipped 0.15.0, its first release since October 2025, from its new home at sobelow/sobelow. The headline: a --no-router flag so plain Elixir projects can be scanned, not just Phoenix apps. It also gains Elixir 1.20 support, a usage-rules.md so AI coding assistants use it properly, and an end-to-end test harness that lifted coverage from 29% to 67%. Given last month's CVE volume, having the scanner actively maintained again is very welcome.

De-slopping AI-generated code

A whole cottage industry of Credo plugins has sprung up to catch the smells LLMs leave behind. ExSlop is the most developed: 40 checks for things like blanket rescues, narrator comments and anti-idiomatic Enum usage. Llamex targets LLM-refactor smells and cheerfully admits to being largely vibe-coded itself, and Jump's credo_checks includes checks aimed squarely at vacuous LLM-generated tests.

Related, and worth sitting with: the Syntax podcast's Vibe Health survey of 1,252 developers found 59% feel their coding skills are diminishing with heavy AI use, 54% report less enjoyment or flow, and 65% feel pressure to produce more. Tools that keep the slop out of your codebase are good; keeping your own skills sharp is better. Come practise both at our September Hack Night.

Elixir for Finance

Elixir for Finance is a new book from Dr. Dimitrios Koutmos and Alexander Koutmos, edited by Hugo Baraúna: market analysis with Livebook, Explorer, Scholar and Nx, from pulling FRED and Yahoo Finance data through portfolio risk and backtesting. It's in beta with five chapters so far, and every chapter ships as runnable Livebook notebooks.

Quick hits

Tidewave Connect lets the coding agent you already run in a terminal or editor (Claude Code, Cursor and friends) plug into your running Phoenix app: click an element in the browser and your prompt is enriched with framework traces, while the agent can query the database, read logs and run code in the live app. Dokploy v0.30.0 is out for the self-hosters deploying Phoenix with it, adding external secrets managers and Cloudflare/Route53 DNS automation. And if you want the wider AI security context, the Black Hat USA debrief on the OpenAI and Hugging Face incident is worth an hour, with a good written timeline from Simon Willison.

08 Aug 2026 · Josh Price

GenStage demand, finally visualised

If you've ever configured a GenStage or Broadway pipeline by copying max_demand and min_demand numbers from a blog post and hoping for the best, Elixir core team member Andrea Leopardi has written the piece for you: Elixir's GenStage Demand (a Visual Explainer).

The framing that makes it click: concurrency gives us more workers; demand tells us when to stop sending them work. Back-pressure is the whole point of GenStage, and the post walks through it visually. max_demand caps how many events can be in flight for a subscription at once, while min_demand is the threshold that triggers the consumer to ask the producer for more. Seeing the numbers flow between stages makes it obvious why the defaults behave the way they do, and what actually changes when you tune them.

Andrea co-wrote Testing Elixir and his posts are reliably worth your time. This one deserves a bookmark for the next time someone on your team asks why their pipeline sits idle in batches, a question min_demand usually answers.

29 Jul 2026 · Josh Price

elixir-lang.org has a new look

elixir-lang.org has had its first major redesign in years: a cleaner, more modern homepage that leads with what people build on the BEAM, real companies and use cases up front, plus refreshed branding and easier paths into the docs.

There's no blog post announcing it (the site itself is the announcement), but José Valim filled in the story in the Hacker News thread, which racked up 250+ points: the design is by the Software Mansion folks, iterated on together in Figma, and José rewrote all of the copy himself with feedback from the core maintainers. The thread's reception says a lot about where Elixir sits in 2026: less "what is this language?" and more appreciation for a mature ecosystem that keeps investing in its front door.

If you want the community hot takes, the first episode of the new Macro Mayhem podcast spends a chunk of its news segment on the redesign.

29 Jul 2026 · Josh Price

Macro Mayhem picks up where Thinking Elixir left off

When the Thinking Elixir podcast wrapped up in June after six years of weekly episodes, it left a real hole: it was the way a lot of us kept up with Elixir news on the commute.

Enter Macro Mayhem, a new podcast from Peter Ullrich and Gus Workman covering the latest Elixir news and broader software industry topics. Episode 001, "Redesigns, Conferences, and Rogue Agents", landed on 27 July and sets the template: Hex 2.5.0's new vulnerability warnings, the elixir-lang.org redesign, the conference season ahead (Goatmire with AshConf, ElixirConf US, Code BEAM EU), and a discussion segment on AI news of the week.

Subscribe on Apple Podcasts or Spotify, or grab the feed from macromayhem.fm. And thanks to the Thinking Elixir crew for six great years.

29 Jul 2026 · Josh Price

New OTP CVE batch: patch to 29.0.4, 28.5.0.4 or 27.3.4.15

Two weeks after July's big round-up, the Erlang Ecosystem Foundation CNA has published another batch: eight Erlang/OTP CVEs on 27 July and two for Cowboy/Cowlib on the 28th. The headline is a critical TLS client authentication bypass in ssl. If your app makes TLS connections (and it does), update OTP.

Erlang/OTP

• CVE-2026-55953 CRITICAL 9.1: the TLS 1.2 (and earlier) and DTLS client accepts a cipher suite the server selected even if the client never offered it, enabling an algorithm downgrade and adversary-in-the-middle against ssl clients.

• CVE-2026-58227 HIGH 8.7: TLS/DTLS denial of service via unbounded recursion on a cross-signed peer certificate chain.

• CVE-2026-59251 HIGH 8.7: public_key DoS via exponential certificate-policy-tree growth during path validation.

• CVE-2026-59250 HIGH 8.3: Megaco flex scanner buffer overflow via an oversized property parm name.

• CVE-2026-54890 HIGH 8.2: BEAM VM crash via an integer underflow in binary_to_term BIT_BINARY_EXT decoding, a DoS anywhere you decode untrusted external term format.

• CVE-2026-42792 MEDIUM 6.3: epmd permanent DoS via file-descriptor exhaustion (EMFILE) on accept(2).

• CVE-2026-55737 MEDIUM 5.1: heap pointer corruption via a signed/unsigned mismatch in LARGE_TUPLE_EXT decoding.

• CVE-2026-47078 MEDIUM 4.8: relative path traversal in zip:unzip/1 and zip:extract/1 via a depth-counter bypass in check_dir_level.

  Fix Upgrade Erlang/OTP to 29.0.4, 28.5.0.4, or 27.3.4.15. Same drill as two weeks ago: an OTP upgrade, not a Hex bump.

cowlib

• CVE-2026-59248 HIGH 8.7: unbounded HPACK/QPACK prefixed-integer decoding, a memory-exhaustion DoS reachable through HTTP/2 and HTTP/3.

  Fix Upgrade cowlib to 2.19.0.

cowboy

• CVE-2026-65624 MEDIUM 6.9: duplicate header names bypass the HTTP/1.1 max_headers limit, enabling memory exhaustion.

  Fix Upgrade cowboy to 2.18.0. Newer Phoenix apps default to Bandit, but plenty of deployed apps still serve on Cowboy, so check your lockfile.

What to do

1. Update OTP first: the critical ssl cipher-suite bypass undermines TLS server authentication for every outbound connection your node makes.
2. Run mix hex.audit for the Cowboy/Cowlib pair, and remember Hex 2.5 flags advisories during mix deps.get (see the Hex 2.5 write-up).
3. Watch the EEF CNA advisory list. At this cadence it's worth a bookmark.

The pattern from the last batch holds: mostly DoS via unbounded resource use, but the one that isn't (the TLS downgrade) is the one to lose sleep over. Patch that today.