CLOUDFLARE WHACKS WAF BYPASS BUG THAT OPENED SIDE DOOR FOR ATTACKERS

Summary from the TLDR InfoSec newsletter

Cloudflare has fixed a vulnerability in its WAF that could allow attackers to bypass security rules and directly access origin servers. The vulnerability emerged when Cloudflare disabled security features upon receiving an HTTP-01 ACME challenge without verifying that the challenge token was valid. Cloudflare remediated this issue with no customer action by disabling WAF features only when the challenge token matches a legitimate token for that domain.