The Double-Edged Sword of Automation: A Deep Dive into ACME and the Recent Cloudflare Zero-Day
How the ACME protocol automates TLS certificates, and how a now-patched Cloudflare zero-day let ACME traffic bypass the WAF.
U Debasish Rao
Senior security engineer at Decentro: WAF and detection engineering, API security, AI-augmented defence
Latest writing 10 m
- Seclang Deep Dive: Building Smart WAF Rules with Coraza and ModSecurity Cybersecurity Tutorials 11 min
- CVE-2025-55182: 7 Critical Insights Into the React Server Components RCE Case Studies 5 min
- 7 Powerful OWASP Authentication Failures Cybersecurity Tutorials 3 min
- 5 Powerful Nginx Caching Secrets to Drastically Boost Performance Cybersecurity Tutorials 10 min
- 7 Powerful Ways to Prevent Cryptographic Failures Cybersecurity Tutorials 3 min
- OpenAI Mixpanel Incident – 7 Critical Lessons Case Studies 3 min
Selected work 20 m
- BarbicanAn AI security orchestration platform that cut manual L1/L2 alert triage by about 60%.
- In-house WAFA Pingora, Coraza and Nginx Ingress WAF that improved bot fingerprinting accuracy by 48%.
- JA4 bot detectionReal-time TLS fingerprinting that cut automated payment-API abuse by 45% with zero user friction.
Research and topics 40 m
Who's diving 60 m
I'm a senior security engineer at Decentro, securing the infrastructure behind financial APIs. At PhonePe I built an in-house WAF that cut malicious traffic by 45%, a JA4 pipeline that cut bot abuse on payment APIs by 45%, and Barbican, an AI platform that removed about 60% of manual alert triage. Earlier I found 70+ critical vulnerabilities in Cisco, Juniper and McAfee products.
- Lead / Senior Security Engineer (Sole InfoSec Lead) DecentroJul 2026 to now
- Senior Infosec Engineer PhonePeJul 2025 to Jun 2026
- Infosec Engineer PhonePeJul 2023 to Jun 2025
- Security Researcher LoginsoftAug 2021 to Jul 2023
- Co-Founder & Security Analyst Mitigater TechSecureJun 2020 to Aug 2021
Surface and log it
Hiring, a WAF that misbehaves, or a question about a post? Write to me and I'll answer.