The vulnerability was discovered by daytriftnewgen and fixed by fzipi and airween in the latest patch.
Edited: Full discovery story is public now: https://medium.com/@daytrift.newgen/cve-2026-21876-a-short-story-of-a-waf-bypass-discovery-2654a763eb73