Pentesting Hex: Real Findings from the Ægis Initiative
summary
A paid pentest of Hex finds zero criticals but one high-impact bug: HX1 unsafe deserialization of Erlang terms that could be abused via web cache poisoning (fixed before release); a second class of findings targets CI with a powerful GitHub Actions misconfig that AI agents can weaponize. Scanners across 1,000 packages surface many issues (15 billion downloads, ~26,000 packages; ~52 of first 120 show problems), prompting 230 CVE workflows and a plea for sustained ecosystem funding.
AI-written summary · about
chapters (10)
- 0:00Ægis Initiative intro
- 2:10Erlang Ecosystem security
- 4:58Hex pentesting process
- 10:42Hex security findings
- 16:41Audit improved security
- 19:25AI and vulnerability speed
- 23:18Erlang CVE program
- 30:44Tooling isn’t enough
- 33:53Varcel vulnerability future
- 35:18Cost of shared security
related talks
29mBuilding a Hackbot: How Ethiack's Hackian Finds Real Vulnerabilities
46mHex
41mLive Hacking: Breaking into Your Web App
46mLive hacking: Breaking into your Java web app
38mHackers Gonna Hack: Identifying and Fixing Vulnerabilities Proactively
45mFinding Vulnerabilities through Static Analysis and Scripting
57mEnterprise Ethical Hacking Cloud Applications
32mPicking the Low-Hanging Fruit – Easy Pentest Wins