Supply chain and platform secrets keep getting stolen

LiteLLM 1.107.0 on PyPI was compromised to install a credential stealer and backdoor. Railway disclosed a security incident, and users in its Discord confirmed their stored secrets were used by third parties, which suggests attackers could read decrypted environment variables. A post on PingCAP's TiDB leak claims the attackers hold the complete TiDB Cloud control plane. One commenter lined it up with a Google Cloud outage and a CA private key leak and asked why nobody is talking about it more.

The certificate side is part of the same story. A CVE covers a compromised intermediate CA from emudhra. Go is already blocking its certificates, and Gentoo pushed a ca-certificates update. Amazon Linux is called out for lagging on revocations. Meanwhile mitmproxy added an --emudhra option, and a commenter says someone's security disaster becomes someone else's feature.

This is the key bit: the trusted middle layers are the target. That means package registries, deploy platforms, managed databases and CAs. Your own code isn't the weak point.