Cloudflare Zero-day: Accessing Any Host Globally
Author: FearsOff (@k_firsov / @FearsOff; no individual byline stated in the article metadata) Published: October 28, 2025 Source: https://fearsoff.org/research/cloudflare-acme Summary FearsOff disclosed a global Cloudflare WAF bypass in which requests to the certificate-validation path /.well-known/acme-challenge/{token} were served by the customer’s origin even when customer and account-level WAF rules were configured to block all traffic. Because … Read more