Hacker News Reader

I am wondering if there was any reports (on large scale systems) on what hackers were looking for on servers?

Cloudflare's WAF managed rulesets changelog might be helpful for this: https://developers.cloudflare.com/waf/change-log

For example, they did an emergency update on 1/22 in response to CVE-2023-22527.