A few hours after the start of the Heartbleed challenge, actually, just 3 hours after the start of the Heartbleed challenge. Fedor Indutny seems to have cracked it.

So now, chaos begins. If you own a certificate, you not only have to change it, but you also have to revoke it. I wonder how many will change, and how many will revoke.

You can check that he indeed did it by doing this:

Just to confirm it: put this into your /etc/hosts “165.225.128.15 http://www.cloudflarechallenge.com ” and visit “https://www.cloudflarechallenge.com/ “.

here why it works:

Putting that mapping in /etc/hosts lets your machine skip DNS lookup for that hostname, and just use his IP for that domain name.
Then, your browser checks the received certificate against the authenticated TLS connection, and sees that all is well, allowing you to connect without a warning.
Since the browser does not warn of a certificate mismatch, he must have a valid certificate for ‘cloudflarechallenge.com’. QED.

The Cloudflare team reviewing the attack: