CLAIM-2026-09-28-02
Oren Yomtov of the Accomplish security research team reported the vulnerability through HackerOne on 4 September 2026 at 15:26 UTC; Cloudflare confirmed the production flaw at 18:45 UTC and merged a runtime fix at 21:27 UTC the same day.
Why it matters
The processor knew on 4 September. If you are a controller on that infrastructure, that is the date your Article 28(3)(f) request is about.
Sources
- cloudflare2026how