From John Graham-Cumming’s post on Cloudflare’s blog,
On July 2, we deployed a new rule in our WAF Managed Rules that caused CPUs to become exhausted on every CPU core that handles HTTP/HTTPS traffic on the Cloudflare network worldwide.
A very well written summary that actually acts as a pretty good advertisement for Cloudflare.