@maennchen.dev will be at @elixirconf.bsky.social presenting "Pentesting Hex: Real Findings from the Ægis Initiative," alongside Michael Lubas. They will share results from two real-world penetration tests of Hex, funded through our Ægis Initiative. elixirconf.com/talks/pentes...

Pentesting Hex: Real Findings from the Ægis Initiative

Every Elixir developer uses the Hex package manager to ship their project. Businesses, universities, and even governments all rely on this critical infrastructure to adopt Elixir and deliver high…

elixirconf.com

The hexpm package pages are now generated by MDEx and Lumis, thanks to @maennchen.dev ! - Better GitHub Flavored Markdown - Light/Dark themes - Syntax highlighting for more languages and sigils - HEEx, Python, Lua, Svelte, React, etc And more... #MyElixirStatus

Catch my keynote at @elixirconf.bsky.social in September😎. I'll be talking about how to augment and empower large engineering teams with AI 🤖. I've also got some spicy topics for you all, not shying away from the hard questions of the day 👊 elixirconf.com/talks/exoske...

HexDocs URLs are changing! Public package docs move from hexdocs.pm/package to package.hexdocs.pm, and private organization docs move from org.hexdocs.pm/package to org.hexorgs.pm/package Funded by Alpha-Omega through EEF's Ægis initiative. Learn more 👇 hex.pm/blog/hexdocs...

Our CISO @maennchen.dev joined this episode to talk about what securing the BEAM ecosystem actually looks like today — CVE coordination, the EEF's CNA, and what's changed. www.youtube.com/watch?v=FulS...

AI Found 5 CVEs in One Afternoon — The BEAM Security Wake-Up Call | Peter Ullrich & Jonathan Machen

YouTube video by BEAM There, Done That

youtube.com

The Beam There, Done That podcast episode with me and @maennchen.dev is out! www.youtube.com/watch?v=FulS...

AI Found 5 CVEs in One Afternoon — The BEAM Security Wake-Up Call | Peter Ullrich & Jonathan Machen

YouTube video by BEAM There, Done That

youtube.com

One third is a wild number. 😂 Atom exhaustion is one of those BEAM-specific issues that feels obvious once you know it, but keeps showing up in real vulnerabilities. Worth a read if you maintain #ElixirLang / #Erlang libraries or apps.

Jonatan Männchen@maennchen.dev · 2mo ago

Atom exhaustion is not just an old BEAM footgun. As of today, 35% of CVEs published by the EEF CNA fall under uncontrolled resource consumption, with atom exhaustion being one of the recurring causes. It’s well understood, documented, and preventable. erlef.org/blog/securit...

Atom exhaustion is not just an old BEAM footgun. As of today, 35% of CVEs published by the EEF CNA fall under uncontrolled resource consumption, with atom exhaustion being one of the recurring causes. It’s well understood, documented, and preventable. erlef.org/blog/securit...

🚨 Update hackney 🚨 A **bunch** of vulnerabilities I reported in hackney were just disclosed. Please upgrade to 4.0.1 ASAP. I know this is gonna start dependency hell so please take some time for this. Please RT for reach. #ElixirLang cna.erlef.org/cves/

If you’re running #Phoenix Channels (or LiveView) and have the LongPoll option enabled in your endpoint (default since 1.7.11), it’s time to do an update: github.com/phoenixframe... Thank you @peterullrich.com for finding and disclosing this issue!

Long-poll NDJSON body splitting causes large memory allocation in Phoenix

### Summary An unauthenticated denial-of-service vulnerability in Phoenix's long-poll transport allows a remote client to allocate a large amount of memory with a HTTP request. A handful of conc...

github.com

The 5 vulnerabilities I found in Bandit were fixed and released today. Please go upgrade bandit ASAP. Thanks to @mtrudel.bsky.social for fixing them so quickly and to @maennchen.dev for managing the process 🙏 #ElixirLang cna.erlef.org/cves/

Securing Hex, the Backbone of the Elixir Ecosystem paraxial.io/blog/hex-pen...

Scaling Security from Zero by @maennchen.dev CISO of our Foundation! Learn how a Small OSS Ecosystem Jumped Into the Deep End! Jonatan talk at Code & Compliance is now live: www.youtube.com/watch?v=jl89...

Scaling Security from Zero: How a Small OSS Ecosystem Jumped Into the Deep End | Jonatan Männchen

YouTube video by Eclipse Foundation

youtube.com

Can Erlang run on QNX? Turns out: yes ✅ In this article, @maennchen.dev explores what it takes to port Erlang/OTP to QNX. A great example of curiosity turning into concrete results. erlef.org/blog/eef/otp...

Hi Elixir friends, After 3 years on Hologram full-time (transpiles Elixir to the browser), I'm at a crossroads. 60+ hr weeks balancing contracts & dev isn't sustainable. Where we are & how you can help: hologram.page/blog/seeking... Even sharing helps 💜 #Hologram #Elixir #ElixirLang #BEAM #WebDev

I really like what Hologram is building, there’s a lot of potential there to take it further. If you haven’t yet, consider sponsoring. I just did myself. Feels like one of those projects where a bit of support now could have a big impact later. bsky.app/profile/bart...

Bart Blast@bartblast.com · 8mo ago

Hi Elixir friends, After 3 years on Hologram full-time (transpiles Elixir to the browser), I'm at a crossroads. 60+ hr weeks balancing contracts & dev isn't sustainable. Where we are & how you can help: hologram.page/blog/seeking... Even sharing helps 💜 #Hologram #Elixir #ElixirLang #BEAM #WebDev

The Erlang Ecosystem Foundation CNA now publishes vulnerability data directly to OSV.dev. No more relying solely on CVE→OSV conversion. This update means faster, cleaner, and higher-quality security data for the BEAM ecosystem — including Erlang, Elixir, Gleam, and Hex.pm.

At Code BEAM Europe 2025 @maennchen.dev : War stories from a security disaster. What to do when everything breaks.

🗓️ Nov 7- BEAM Unconference 1000-1500 7/11 luma.com/qyfevatp Lightning talks, deep dives & community.

BEAM Unconference: Berlin · Luma

⁠Let’s unconference before you go! Wrap up your week with something a little more spontaneous and social, and all about the BEAM ecosystem. The BEAM…

luma.com

💜 @elixir-lang.org v1.19 is the first release with OpenChain certification — bringing more transparency and trust to the BEAM ecosystem. Big thanks to @maennchen.dev and our sponsor Herrmann Ultraschall for making this milestone possible! 👏 🔗 elixir-lang.org/blog/2025/02... #Elixilang

I received a small donation mentioning ads.fund, which apparently created a token around my open-source project. I’m not sure what to make of it and would appreciate community input on whether it’s legitimate or something to distance from. github.com/maennchen/Zi...

💬 Input wanted: ads.fund “Zipstream PHP” token · Issue #382 · maennchen/ZipStream-PHP

Hey everyone, I recently got a small donation through GitHub Sponsors, and the message mentioned something called ads.fund (@ADS-Fund). That made me look into it, and apparently there is a token on...

github.com

Hey folks! We have a CVE up for #AshFramework bypass policies. It's a *highly unlikely edge case*. But, as always, we take security extremely seriously and will always follow proper procedure here. Props to @maennchen.dev for reporting and resolving 🙇

Elixir Radar issue 486 is out! 📣 You can read it here: buff.ly/2UM7hp6 This issue comes with content from @shahryar-tbiz.bsky.social @katafrakt.bsky.social @maennchen.dev @elixircasts.io , Matt Savoia and Yatender Singh . Thank you! #ElixirLang

Elixir Radar 486

buff.ly

We have made major progress toward CRA readiness for the BEAM ecosystem! 🔙So far: CNA operations, OpenChain certification, and more already in place. 🔜Next up: signed OTP builds to lower compliance costs and strengthen sustainability. security.erlef.org/assets/aegis...

Another 🔥 package release from @maennchen.dev 😎 AshDiagram is a library for generating beautiful diagrams to visualize your #AshFramework applications. Generate Entity Relationship, Class, C4 Architecture, and Policy diagrams directly from your Ash resources and domains. 🚀

What if the BEAM got hit by a worm? 🪱 We’ve been lucky so far — but luck runs out. The Ægis Initiative is how we defend our ecosystem. 👉 Read more & support: erlef.org/blog/eef/bea... #Erlang #Elixirlag #Gleam

One package. One update. A worm crawling through the BEAM ecosystem. A dark “what if” — and how we can stop it before it’s real. erlef.org/blog/securit... #erlang #elixirlang

There‘s still a bit to go to making this happen. Rebar is an important piece to using erlang not just for erlang, but just as much for elixir, gleam, … Consider backing this effort.

Erlang Ecosystem Foundation@theerlef.bsky.social · 11mo ago

🎥 From Rebar3 to Rebar4: Peer Stritzinger on why this matters for the BEAM community. 👇👇 www.kickstarter.com/projects/pee...

@maennchen.dev has just released the first version of Clarity: hexdocs.pm/clarity/Clar... Clarity is an interactive introspection and visualization tool for Elixir projects.