A subtle bug in Cloudflare’s ACME validation logic risked turning its shield into a sieve, leaving countless web servers open to stealth attacks-until a white-hat warning forced a rapid fix.