Cloudflare CEO says company built new WAF to mitigate newly found vulnerabilities

The significance here is less the disclosure than the distribution model: a newly built WAF switched on by default for every customer turns a security response into a baseline expectation across Cloudflare's entire customer base, at no extra cost. That matters for any business relying on Cloudflare as its edge, since protection arrives without a procurement or configuration step. The notable gap is transparency — the company declined to detail the vulnerabilities or the mitigation, leaving the affected scope unclear. Whether Cloudflare later publishes technical detail, and whether other edge providers follow with default-on defenses, is the open question.