Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

Cloudflare ACME HTTP-01 WAF bypass security flaw

Vulnerability
First reported
Last updated
Happening score
H score 6
1 unique sources, 1 articles

Summary

Hide ▲

Cloudflare's ACME HTTP-01 validation flaw let requests to `/.well-known/acme-challenge/*` bypass WAF protections and reach origin servers. Cloudflare said it fixed the issue on October 27, 2025 after FearsOff reported it in October 2025, and it found no evidence of malicious exploitation.

Related Happenings

Aisuru/Kimwolf botnet record DDoS campaign against telecommunications and IT companies

Campaign
H score60 First: 29.01.2026 16:55 Last: 29.01.2026 16:55 Sources 1

About this happening: The Aisuru/Kimwolf botnet campaign expanded in late 2025 with Kimwolf, a DDoS botnet compiled using the NDK, and evidence linking it to AISURU through shar...

Latest development: 20.03.2026 02:49

The U.S. Justice Department, with authorities in Canada and Germany, dismantled infrastructure behind Aisuru, Kimwolf, JackSkid and Mossad, seized U.S.-registered domains and virtual servers used in DDoS attacks against DoD Internet addresses, and said the action was intended to prevent further infections and future attacks.

Open Happening

Cloudflare BGP route leak from router policy misconfiguration disrupts IPv6 traffic

Service Disruption
H score3 First: 26.01.2026 19:50 Last: 26.01.2026 19:50 Sources 1

About this happening: Cloudflare experienced a 25-minute BGP route leak that disrupted IPv6 traffic, causing congestion, packet loss, and about 12 Gbps of dropped traffic. The issue ext...

Open Happening

Exposed security-training web apps exploitation wave

Exploitation Wave
H score41 First: 21.01.2026 16:00 Last: 21.01.2026 16:00 Sources 1

About this happening: DVWA, OWASP Juice Shop, Hackazon, and bWAPP instances exposed in cloud environments are being actively exploited, putting Fortune 500 companies and securit...

Open Happening

Publicly exposed training apps as recurring cloud-entry risk across security vendors

Trend
H score17 First: 21.01.2026 16:00 Last: 21.01.2026 16:00 Sources 1

About this happening: Cybersecurity training apps left exposed on the public Internet are creating a recurring cloud-entry risk for security vendors and enterprise users. A scan identified...

Open Happening

Kimwolf botnet infects Android TV streaming boxes for DDoS and proxy abuse

Malware Activity
H score16 First: 09.01.2026 01:23 Last: 09.01.2026 01:23 Sources 1

About this happening: Kimwolf/Aisuru botnet activity now spans Android TV streaming devices and record-setting DDoS attacks. Cloudflare says the latest campaign, “The Night Before Christm...

Latest development: 20.03.2026 10:05

Authorities from the United States, Germany, and Canada disrupted Command and Control (C2) infrastructure used by the Aisuru, KimWolf, JackSkid, and Mossad botnets to infect Internet of Things (IoT) devices and launch hundreds of thousands of DDoS attacks, including attacks against IP addresses owned by the Department of Defense Information Network (DoDIN).

Open Happening

Timeline

  1. 20.01.2026 13:12 2 articles · 5mo ago

    Cloudflare ACME HTTP-01 WAF bypass security flaw

    Initial Disclosure

    In October 2025, a flaw in Cloudflare's ACME HTTP-01 handling was identified after requests to the challenge path were found to route in ways that could bypass WAF controls. The issue was then fixed on October 27, 2025.

    Show sources
    Open in new tab