Several major Lemmy instances were hacked due to an XSS vulnerability. There's a path forward for mitigation, but here's what happened.