Attack traffic doesn’t necessarily mean the attacks were, or would have, succeeded.

From Cloudflare’s perspective, there is no downside to saying what they observed, and deploying defenses.

We may never know if this was actually being successfully exploited prior to patch availability.

You shouldn't wait until the attacks succeed to start deploying defenses.

	▲	cryptonym 12 hours ago \| parent [-]
		Unless you are on embargo and don't want to give more details to attackers. Seeing specific requests being blocked is very valuable information about upcoming vulnerabilities. If you own a website and see what kind of requests are denied by your Edge/Cloud provider, you can easily gather details and deduce which tools and specific features are broken. With deontology, you prepare the rules and wait for the embargo to be lifted and don't overdo it on fear marketing. Of course if things are getting sideway and people starts leaking details, that's another story.