The bug lived in WP Rocket’s Cloudflare compatibility file, inc/ThirdParty/Plugins/CDN/Cloudflare.php, around line 562. The plugin’s substr() call received an integer