I'm not from Cloudflare, or particularly a fan of theirs, but they are doing a few things about this, including a new WAF capability: https://blog.cloudflare.com/full-transaction-waf/ and automatic protection for all customers https://blog.cloudflare.com/php-vulnerabilities-waf-protecti...

These were rolled out before the exploit became public.

I would wouldn't describe that as damning.