I had a huge spike in PHP hacking attempts on the 20th, the day before the announcements. It was substantial enough that it was almost a DDoS attack and I had to mitigate it.

Curiously, all of the requests were coming from Cloudflare-controlled IP addresses (Workers? VPN? Internal server?). This of course means that these attempts would succeed for anyone that was whitelisting Cloudflare IPs but blocking others.

I tried to get this information over to them, but their abuse contact form does not allow you to submit unless you have a non-IP domain URL as evidence, which I didn't have because it's just source IPs. Suffice to say if you are behind Cloudflare and think whitelisting only their IPs is protecting you, think again.