I thought they were down earlier, but apparently they were just pre-announcing being down in about 30 minutes, until they finish patching their servers.

I've seen a number of notifications on X and Bluesky of people taking their sites offline, though. Supposedly Cloudflare is providing all customers a WAF rule that will mitigate the exploits they've been able to see so far (though they mention, this is not full protection—patching is still required).