Is this the new normal, or just, uh, normal?

Big embarrassing network-exploitable bugs in major open-source projects happen sometimes, and network-scanning attack botnets have been around forever. Small shady CAs mess things up sometimes. People upload malware to PyPI and NPM all the time, and "move fast and break things" software-deployment startups get breached all the time, to the point where it doesn't even really feel like news to me when those things happen again.

It's unfortunate that a few of those events all happened at around the same time. But, like, even if that's not a coincidence and these events are actually happening more frequently, you should have been preparing for them anyway!

Yes, this is a new normal. No amount of what we historically would have thought of as "normal" preparation can prepare you for being instantly 0-dayed across one or sometimes multiple simultaneous fronts. Merely mentioning something tangentially related to a 0-day is generally enough for any random joe to "clean room" recreate the 0-day and be off to the races.

The historic embargo system is likely not sustainable and we need a shift in both approach and security posture (ie fully trustless architectures by default). Not only that, but because of the insanely amplified frequency and risk of the 0-days, you generally have to throw the baby out with the bathwater and leave yourself completely vulnerable to supply chain attacks. Because not short-circuiting taking upstream updates leaves you open to attack.

Theres shades of the old normal in this stuff, but absolutely this is the dial being turned up to 11 and I dont know if theres any right answers for small teams out there.