Today the Ruby team released Ruby 4.0.9, 3.4.12, and 3.3.13, fixing memory safety bugs in the regular expression engine. GitLab found that specially crafted patterns could corrupt memory while Ruby compiles them, and used that for remote code execution on GitLab servers. The four ids to track are CVE-2026-89078, CVE-2026-93577, CVE-2026-97229, and CVE-2026-110264, all assigned by GitLab, because the Ruby project has not requested its own.

Paraxial.io for Ruby version 1.5.0 is out today with a new cop, Paraxial/DynamicRegexp, which finds the code in your application that reaches these bugs.

The eMudhra Intermediate CA Compromise site details how the private keys of eight eMudhra intermediate CA certificates are not secret. You may have seen reporting by now that one of the private keys used was the integer ‘4’. In summary, eMudhra did not generate their private keys correctly and now anyone on the internet can make a certificate for any domain, and many non-browser TLS clients, including Erlang’s :ssl, will accept it. Firefox, Chrome, Apple and Microsoft now block the intermediates with their own revocation data. Developers need to update their software and packages.

If you are responsible for a deployed Elixir/Phoenix application, this means an attacker who sits between your application and an intended destination (such as an API server) can impersonate that destination, and read and change all traffic between them. To divert the traffic, the attacker needs a DNS hijack, a BGP hijack, a compromised proxy, or one compromised host in your network. Before this incident, the lack of a trusted certificate usually stopped these attacks. That protection is gone, hence the current rush to patch this vulnerability.

If you are an Elixir developer, this means you must update every CA store your application uses.

Paraxial.io for Elixir version 2.12.0 adds Erlang/OTP vulnerability scanning to mix paraxial.scan. The scan now reports the known security advisories that affect the Erlang/OTP version your project is running on, alongside the existing hex dependency, license, and Sobelow results. Here is everything you need to use it.

Upgrading

Every year billions of medical images are produced: CT scans, X-rays, MRIs, echocardiograms. Once the image is created, the goal is to effectively use it to treat the patient correctly, yet this data often goes completely dark the day after it is read. It sits in hospital archives, expensive to store, impossible to search, and invisible to researchers and doctors working to cure diseases and treat patients.

Avandra Imaging is solving this problem by powering the future of Imaging Intelligence. Its image exchange products run inside IDNs, community hospitals, specialty clinics, and outpatient imaging centers nationwide — and that same on-site footprint powers a data platform that indexes existing PACS and VNA archives and de-identifies studies before they leave the health system, turning data that used to go dark into curated, privacy-protected imaging data for research and modern artificial intelligence.

Paraxial.io was honored to be selected by Avandra for a penetration test of its information systems. Avandra uses Elixir, a language Paraxial.io has extensive security experience with, to ensure highly reliable uptime and system access for customers. For example, Paraxial.io open-sourced the first runtime application self-protection (RASP) library for Elixir, to prevent remote code execution (RCE) vulnerabilities in critical systems.

Thank you everyone who attended ElixirConf US 2026 this year. Being able to connect with Paraxial.io customers and users in-person was incredible, and I am grateful for the opportunity to help secure the important work everyone is doing with Elixir.

My talk from the conference, Pentesting Hex: Real Findings from the Ægis Initiative is up on YouTube now! https://www.youtube.com/watch?v=_fER9bzlSOE

The talk covers the security audit of the Hex package manager that Paraxial.io performed under the Erlang Ecosystem Foundation’s Ægis Initiative, funded by Alpha-Omega. If you want the written version, see Securing Hex, the Backbone of the Elixir Ecosystem, and the full public report.

Security firm Safeguard.sh published an Elixir guide last month (July 2026) that tells developers to defend against untrusted deserialization with the following:

# SAFE -- refuse unsafe constructs, and never create new atomsterm = :erlang.binary_to_term(untrusted, [:safe])

The Erlang Ecosystem Foundation’s (EEF) Security Working Group prudently launched the Ægis Initiative in 2025 to improve supply chain integrity for the overall Erlang and Elixir ecosystem. Jonatan Männchen (EEF CISO) and Alistair Woodman (EEF Board President) are the project leads, who have worked tirelessly to ensure the security and health of this critical infrastructure. The Supply Chain Security Audit project under Ægis scoped out a full assessment of the Hex Package Manager and related software. Hex boasts over 14 billion all time downloads, over 24,000 available packages, and is a vital asset for all companies using the Elixir, Erlang, and Gleam languages. Two firms were selected to perform this audit: Paraxial.io and zentrust partners GmbH. The Hex project has published an excellent summary of the work on their blog.

The funding for this work was generously provided by Alpha-Omega, an associated project of the Open Source Security Foundation (OpenSSF) and The Linux Foundation. Funding for Alpha-Omega is provided by Anthropic, AWS, Citi, GitHub, Google, Google DeepMind, Microsoft, and OpenAI. These organizations are deeply committed to improving the security of the open source ecosystem, as shown by their real world action. Their financial support directly protects the foundation of our digital infrastructure. Paraxial.io was honored to be selected as a recipient of this grant, for the security assessment of Hex.

What were the key results?

No additional configuration is required. Paraxial.io detects which HTTP client is available at runtime and uses it automatically. If Req is installed, it takes priority. If only HTTPoison is present, it will be used as before. If both are available, Req is preferred.

Note that 2.9.0 introduces a breaking change: if your project does not currently have an HTTP client defined, you will need to add one explicitly. The recommended choice is {:req, "~> 0.5"} for new projects. Existing projects that require backwards compatibility can define {:httpoison, ">= 1.0.0"}. In either case, declaring your HTTP client as a direct dependency rather than relying on a transitive one is recommended, so that upstream library changes don’t unexpectedly affect your setup.

That promise comes with an unusually high security bar. Being trusted with someone’s most sensitive documents means a breach isn’t just a data incident, it’s a potential catastrophe for real families. Founder Jacob Luetzow built Killswitch on a zero-knowledge architecture: files are encrypted in the browser before upload using AES-256-GCM, with keys derived from the user’s password. The server never sees plaintext. But zero-knowledge encryption doesn’t protect against credential stuffing, SQL injection, or code execution payloads hitting the app in production, which is where Paraxial.io comes in.

Paraxial.io handles the threats that good code alone can’t stop. Bots probing for account credentials get blocked before they can compromise a single user. Automated scanners looking for vulnerabilities get banned on first contact. Attackers attempting to brute-force their way into sensitive documents hit rate limits and are locked out automatically. Any attempt to inject malicious code through request parameters is detected and banned instantly. And every code change is scanned before it ships, so vulnerabilities never quietly make it into production.

1. Code Rabbit is an AI code review startup.

You can read the full text in the pull request above, the documentation covers the following OWASP Top 10 vulnerabilities in Phoenix applications:

That’s why we use Paraxial.io. It’s helped us improve our security posture, reduce engineering overhead, and meet the rigorous expectations of our customers, without getting in the way.

Security Designed for Elixir

James Berthoty, a cybersecurity industry expert, noted the lack of support in a recent post.

A serious vulnerability has been identified in the Erlang/OTP SSH server that may allow an attacker to perform unauthenticated remote code execution (RCE). By exploiting a flaw in SSH protocol message handling, a malicious actor could gain unauthorized access to affected systems and execute arbitrary commands without valid credentials.

All users running the Erlang/OTP SSH server are impacted by this vulnerability, regardless of the underlying Erlang/OTP version. If your application provides SSH access using the Erlang/OTP SSH library, assume you are affected.

Risk Assessment 3.2 - Identify, analyze, and manage risk