I had a huge spike in PHP hacking attempts on the 20th, the day before the announcements. It was substantial enough that it was almost a DDoS attack and I had to mitigate it.
Curiously, all of the requests were coming from Cloudflare-controlled IP addresses (Workers? VPN? Internal server?). This of course means that these attempts would succeed for anyone that was whitelisting Cloudflare IPs but blocking others.
I tried to get this information over to them, but their abuse contact form does not allow you to submit unless you have a non-IP domain URL as evidence, which I didn't have because it's just source IPs. Suffice to say if you are behind Cloudflare and think whitelisting only their IPs is protecting you, think again.
Curiously, all of the requests were coming from Cloudflare-controlled IP addresses (Workers? VPN? Internal server?). This of course means that these attempts would succeed for anyone that was whitelisting Cloudflare IPs but blocking others.
I tried to get this information over to them, but their abuse contact form does not allow you to submit unless you have a non-IP domain URL as evidence, which I didn't have because it's just source IPs. Suffice to say if you are behind Cloudflare and think whitelisting only their IPs is protecting you, think again.