Cloudflare invites hackers to beat its firewall in front of vulnerable PHP
After last week's serious PHP flaws, Cloudflare wants real-world proof that its web firewall rules really block attacks.
A deliberately vulnerable PHP server behind its firewall, with a hidden flag file, run as a bug bounty challenge on HackerOne. It stresses the firewall is no substitute for patching.