Post-mortem and remediations for the Matrix.org security breach
Author here - hopefully the level of detail here will let others learn from our mistakes (and hopefully benefit from how we've chosen to fix them going forwards).  Happy to answer any/all questions or comments.TL;DR: keep your services patched; lock down SSH; partition your network; and there's almost never a good reason to use SSH agent forwarding.