Has CF patched that WAF vulnerability yet? Seems it was enabled around the same time as
this exploit was announced, I'm pretty sure it's been around a little longer though as it was attempted on 1splitkey last month.
A bunch of other sites that I deal with, mostly non crypto related are also dealing with the same issue. I'm guessing CF did not so patch it as do a quick and dirty work around and will fix it later.
If this is the final fix, there are going to be a lot of people with a lot of apps that are going to be
really annoyed since there are a bunch of API calls and other things that are not working at the moment.
You wind up with the question of 'is a broken CF better then nothing"
-Dave