WAF SQLi attack spike

Your WAF dashboard shows blocked-request volume jumping 50x, almost entirely SQLi-signature matches (UNION SELECT, OR 1=1, sleep-based payloads) against a single endpoint: GET /api/v2/reports?filter=. The requests come from a rotating set of IPs and the payloads grow more sophisticated over the hour, suggesting an automated tool probing for a working injection. A handful of requests returned 500 instead of being blocked. You're on call for the application security rotation. Triage and respond.