List of domains affected by Cloudflare's SSL traffic leak

Reposted here? https://news.ycombinator.com/item?id=13721452

Guess I did the right thing enabling 2FA everywhere possible, but how come such a huge bug was left open all these months? Not even cloudflare sec team notice it?

today is going to suck