Cloudflare Zero

Cybersecuritynews •Guru Baran • January 19, 2026

A critical zero-day vulnerability in Cloudflare’s Web Application Firewall (WAF) allowed attackers to bypass security controls and directly access protected origin servers through a certificate validation path. Security researchers from FearsOff discovered that requests targeting the /.well-known/acme-challenge/ directory could reach origins even when customer-configured WAF rules explicitly blocked all other traffic. The Automatic Certificate Management […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Cloudflare Zero-Day Vulnerability Exposed A zero-day vulnerability in Cloudflare's Web Application Firewall (WAF) was discovered, allowing attackers to bypass security controls and access protected origin servers. The flaw was identified by security researchers from FearsOff, who noted that requests to the /.well-known/acme-challenge/ directory could reach origins despite WAF rules blocking other traffic. 2 sources 24

Cloudflare Zero

The full story

Extracted Entities

Attack Types (1)

Platforms (1)