🔗Dept of Trust & Safety ⚖️

Sky announces

Today, Cat and Sky want to formally launch Muninn Hall.

Muninn Hall is a new community for public Matrix homeserver staff, from administrators to custodial and janitorial moderators. We want to provide a space to pool knowledge, collaborate, and support each other in the efforts of running publix Matrix homeservers. This can range from Trust & Safety, systems administration, or general community management.

Why Muninn Hall? While there are various Matrix rooms that may look similar to what we aim to do, we couldnt find anything with a comparable concept yet.

The plan is to:

• meet in the Matrix space for easy exchange and coordination between each other
• have the main Muninn Hall website where we want to pool all kinds of relevant documentation regarding public Matrix homeservers
• publish blogs like Introducing Muninn Hall, or maybe a homeserver admin sharing their experiences with $topic

…

Continue reading…

🔗Matrix Live S11E09 – Tammy

🔗Dept of Spec 📜

Andrew Morgan (anoa) {he/him} reports

Here's your weekly spec update! The heart of Matrix is the specification - and this is modified by Matrix Spec Change (MSC) proposals. Learn more about how the process works at https://spec.matrix.org/proposals.

🔗MSC Status

New MSCs:

• MSC4326: Device masquerading for appservices
• MSC4325: Presence privacy

MSCs in Final Comment Period:

• [WIP] MSC2745 : Add hCaptcha as captcha provider (close)
• [WIP] MSC2271 TOTP 2FA login (close)
  • Closed as superseded by next-gen auth work.

Accepted MSCs:

• MSC4304: Room Version 12
• MSC4297: State Resolution 2.1

Closed MSCs:

• MSC4329: Inviting with authorization
  • Opened for informational purposes only.

🔗Spec Updates

This big news this week is the Project Hydra coordinated security release. On August 11th, 2025, updated homeserver implementations were put out to address the vulnerabilities. And the following Thursday, August 14th, the associated spec updates were put out as well (which divulge further details).

The largest part of this is the new Room Version 12, which had a spec PR merged on the same. It explains the changes servers and clients need to make to address the vulnerabilities.

The relevant MSCs and spec PRs were merged and homeserver and client implementations should have already (or should do now if they haven't) updated to support the new changes. However, the changes to the spec won't actually appear in a new spec release until the next release cycle, keeping in line with the usual spec process. The next release is due to go out in the next few weeks as we approach the end of Q3 2025.

Continue reading…

Hi all,

On July 16th 2025 we issued a pre-disclosure for vulnerabilities in the federation protocol, and announced new releases of Matrix homeservers on Mon August 11. Today we are ending the embargo and disclosing the remaining MSCs. This post will go into more detail about the changes and what led up to them.

This project has the codename “Hydra” and is an ongoing exercise in improving the security of the federation protocol. Given the security-sensitive nature of this work, it was done under embargo by the backend team at Element, the Matrix.org Security Team, the Spec Core Team, alongside Timo Kösters (who privately reported a related vulnerability, helping jumpstart the project) and Florian Jacob (at Karlsruher Institut für Technologie). The work was subsequently shared, reviewed and MSC’d under embargo with maintainers of all known Matrix homeserver implementations which implement State Resolution 2.0 on June 13th, so they could prepare for the coordinated release on August 11. We have then given server admins 3 more days to upgrade before lifting the embargo and disclosing the vulnerability details here.

This entire process has been highly unusual for the ecosystem, and it’s unfortunate that we were unable to make these changes out in the open. Where possible, we moved to release redacted versions of the MSCs as soon as we were comfortable from a security perspective (e.g. releasing MSC4289 and MSC4291 ahead of time, with redacted sections). Furthermore, we’d like to apologise for the disruption in landing a new stable room version and specification release with immediate effect rather than allowing for a period of public review. Going forwards, normal MSC work will continue in public as it ever has, along with normal on-cycle specification releases.

Continue reading…

Hi all,

Last month we issued a Pre-disclosure: Upcoming coordinated security fix for all Matrix server implementations, describing a coordinated release to fix two high severity protocol vulnerabilities (CVE-2025-49090; the other not yet allocated a CVE). That release is now available as of 17:00 UTC on August 11, 2025. Server updates are now available, and MSCs & spec updates will follow on Thursday, August 14, 2025, bringing us to version 1.16 of the spec later in the month, and introducing room version 12.

Continue reading…

🔗Matrix Live S11E08 – Stitched History

🔗Dept of Status of Matrix 🌡️

🔗Upcoming coordinated security release reminder

Andrew Morgan (anoa) {he/him} says

A reminder that patches for the coordinated security release of Matrix server implementations will go out this Monday, August 11th 2025 at 17:00 UTC. If you run your own homeserver, please be ready to update around that time to receive security patches!

Further details are available in the original pre-disclosure blog post.

🔗Governing Board (website)

The Governing Board is an advisory board to the Matrix.org Foundation and with elected representatives from all across the Matrix ecosystem.

HarHarLinks reports

🔗Working Group update from the Governing Board

Last week we were excited to announce two new Working Groups! Huge thanks to Nico who is acting as the Governing Board sponsor for both the Trust & Safety Research & Development Working Group and the Room Directory Working Group. You can learn more about both as well as the existing Events Working Group and Website & Content Working Group on the website at https://matrix.org/foundation/working-groups/!

Feedback form getting these new Working Groups set up helped us at the Governing Board identify some parts in our bylaws and processes documents that were a bit more difficult to grasp. The Governance Committee of the Governing Board is responsible for improving both the Governing Board's own as well as the Foundations processes and has been working in parallel to fill the gaps: You can read the new description about what the tasks of Working Group Chairs are at https://matrix.org/foundation/governing-board/bylaws/02-bylaws/#working-group-chairs-and-vice-chairs-expectations. Tl;dr: if you really care about something getting done, then being the chair is your role for ensuring progress keeps getting made.

Continue reading…

🔗Matrix Live S11E07 - Reflections on Matrix criticism over the last week

🔗Dept of Status of Matrix 🌡️

Matthew reports

Travis wrote a great update on recent T&S work over at https://github.com/element-hq/element-meta/issues/2486#issuecomment-3142023818.

🔗Governing Board (website)

The Governing Board is an advisory board to the Matrix.org Foundation and with elected representatives from all across the Matrix ecosystem.

🔗Trust and Safety Working Groups (website)

Nico reports

By the time you read this, you should be able to find documentation about the Trust and Safety working groups doing Research and Documentation as well as planning to support maintaining the matrix.org room directory on the working groups page.

If those interest you and you want to help out, feel free to join their public offices and introduce yourself! Sorry it took so long to set up and it will take a while longer until you see some output from those groups, but we are slowly organizing ourselves!

Continue reading…

Users of the Matrix.org homeserver have recently received – or will shortly receive as the notifications are rolled out progressively – an invite from a user called Matrix.org (Official Account). Those checking the room will have noticed that it announces upcoming changes to our the Matrix.org Homeserver Terms and Conditions.

Some of you have asked us questions about these two events so we would like to offer some clarification and (hopefully) some reassurance.

Continue reading…

🔗Matrix Live S11E06 - Element X Accessibility, Encrypted State Events, Element Web Rich Text Pasting

🔗Dept of Status of Matrix 🌡️

Matthew reports

richvdh wrote an excellent writeup of the nightmare from the Element backend team have been working through in detecting and fixing slow-burning database corruption on matrix.org's postgres, which caused the room corruption outage over the last few weeks: https://matrix.org/blog/2025/07/postgres-corruption-postmortem/

Robin Riley (m.org) reports

Please join us in welcoming < polycule >, a geeky and efficient Matrix client, as the newest Ecosystem Member of the Foundation! ✨

Does your community use Matrix? Or do you maintain a community project that builds on Matrix? Join the Foundation as a member! This helps us demonstrate the breadth of the ecosystem, and all members are entitled to participate in our Governing Board elections.

Continue reading…

Greetings from Element's backend/SRE team, who run the matrix.org homeserver on behalf of the Matrix.org Foundation.

Recently users of the matrix.org homeserver began seeing problems where rooms would simply stop working. Operations such as sending a new message, or joining the room as a new member, would fail for mysterious reasons. Where an error message was shown at all, it tended to be something cryptic like "No create event in auth events".

After a couple of weeks of hard work by a team of Element staff including backend developers and systems engineers, we were able to repair almost all of the affected rooms. Although we're still investigating exactly what went wrong and checking that everything is now working as it should, we'd like to share some details about what we know and the work we've done to date.

We'll be diving into some quite technical details. Hopefully you'll find it interesting learning a bit about how Synapse works, how Postgres works, and the work we sometimes find ourselves doing to keep the matrix.org homeserver running.

🔗TL;DR

Let's start with a high-level summary.

The matrix.org homeserver is backed by a large PostgreSQL database instance. Parts of an index on one of tables in this database had become corrupted. We are unsure exactly what caused this corruption, but believe it happened at least a year ago, and likely significantly longer.

The nature of this corruption was such that it had little or no effect at first. However, a background maintenance task which removes old, unreferenced data from this table recently started working on the corrupted region. Due to the corrupt index, the maintenance task incorrectly removed active data from the table, in effect corrupting rooms.

Having identified the problem, we rebuilt the corrupted index, and then restored the data that had been incorrectly removed, from database backups.

Continue reading…

🔗Matrix Live S11E05 - Project Hydra

🔗Dept of Status of Matrix 🌡️

Matthew reports

On Wednesday we pre-disclosed a major security update on the horizon (codename Hydra) to improve state resets and related federation issues in Matrix. This requires a coordinated security release across all Matrix servers, so that servers running in untrusted federations (e.g. the public Matrix network) can speak the upcoming new room version (v12).

We have just pushed back the date for the coordinated security release to Aug 11th 2025, as we've heard a lot of feedback that 6 days wasn't enough for clients/bots/bridge/tooling developers to test the changes introduced by room v12, and that it also doesn't give enough time for community admins to prepare for the necessary room upgrades. Underestimating the time needed here for client/community testing is entirely our fault, due to being overfocused on coordinating the significant serverside work needed. Pushing back the release date by 3 weeks gives everyone more time to test and prepare. We've also opened up registration on the beta.matrix.org homeserver, which is already running v12 rooms by default, to make it easier for client developers to test their clients. We've also made one clarification below for client developers, explaining the new permissions needed to send m.room.tombstone events.

See https://matrix.org/blog/2025/07/security-predisclosure/ and this week's Matrix Live for all the details.

Continue reading…