[irgeek]

Assuming the GitHub issues are from the actual attacker -- and I see no reason to doubt they are -- this is very troubling:

https://github.com/matrix-org/matrix.org/issues/363

Compromise began well over a month ago

Yikes. That's a long time for a compromise to go unnoticed.

[ygjb]

Not really, the average in the industry seems to be floating between 70 and 400 days depending on the source of your stats on the topic (different vendors and reports use different stats for this)