Like assuming this bears out, and the Portswigger folks are legit, this is a Heartbleed-level vulnerability in all the major CDNs