Cybersecurity researchers have detailed a sophisticated remote **Spectre** attack against **Cloudflare Workers**, showcasing its ability to exfiltrate JSON Web Tokens (JWTs) from a co-located Worker in a production environment. The attack achieved a leakage rate of up to 12 bits per second, a staggering 360 times faster than a similar attack demonstrated in 2021. The experiment involved an attacker Worker and a victim Worker, both controlled by the researchers, with a JWT intentionally placed in the victim's memory. The research paper clarified that no actual customer data was accessed during their tests. **Cloudflare** has confirmed that the attack vector has been mitigated in production. Their response involved enhancing **Dynamic Process Isolation (DyPrIs)**, integrating the **V8 Sandbox**, and deploying **Memory Protection Keys (MPK)**-based in-process isolation. The company also stated that it found no indicators of active exploitation over the past three years. "We demonstrate that the production implementation of DyPrIs was insufficient," the researchers stated in their paper. **Cloudflare Workers** operate by running code from multiple tenants within separate **V8** isolates inside the same operating-system process. This architecture relies on language-level isolation rather than strict process isolation to minimize startup latency. According to **Cloudflare**, a memory read within a shared Worker process can potentially lead to cross-tenant leakage. The attack requires both the attacker and victim Workers to be co-located in separate **V8** isolates within the same Worker process. Crucially, the attacker controls valid code within their own isolate. The threat model does not include native code execution, nor does the attack depend on a **V8** software exploit or sandbox escape. **Cloudflare** had previously implemented measures to restrict local timing sources by freezing or coarsening timers during CPU execution, and by not exposing shared memory or multithreading to Worker scripts. However, the researchers discovered that **WebSocket** communications could serve as a remote timing source. Additionally, **Durable Objects** were found capable of keeping a single Worker isolate alive for extended periods, ranging from five to over 20 hours. **DyPrIs** is designed to isolate suspicious scripts into a separate process after an invocation completes. The researchers found that a long-lived **Durable Object** invocation could continue running before this isolation mechanism was triggered. Furthermore, the team observed that intensive **WebSocket**-heavy input/output (I/O) activity increased instruction translation lookaside buffer (**iTLB**) activity. This, in turn, reduced the normalized branch-misprediction signal used by **DyPrIs** below its detection threshold, allowing the attack to proceed undetected.  **Cloudflare** categorized the issue as a limitation in its **DyPrIs** implementation. In contrast, the research paper contended that the identified weaknesses reflected fundamental limitations of the detection approach itself, rather than mere implementation oversights. The researchers emphasized that robust detection should occur during execution and rely on signals that cannot be suppressed by I/O activity. The production tests were conducted on **Linux** servers utilizing **AMD EPYC Zen 2** and **Zen 3** processors. Measurements were intentionally performed at night, with CPU utilization between 10% and 25%, to achieve optimal results. The researchers noted that higher system load did reduce the leakage rate, though slower attacks remained feasible under such conditions. The paper reported a leakage rate of up to 12 bits per second with 99.16% accuracy, a significant leap from the 2 bits per minute observed in the earlier attack. This disclosure comes nearly five years after **Cloudflare** and **TU Graz** published research demonstrating a remote **Spectre** attack against **Workers** at 120 bits per hour, which also introduced **DyPrIs** as a defense mechanism. The earlier paper reported a 0.61% false-positive rate and concluded that **DyPrIs** provided statistically similar security guarantees to strict process isolation against the **Spectre** attacks evaluated at that time. **Cloudflare** detailed additional **Workers** hardening measures in September 2025. The deployed mitigations include: * **Improved DyPrIs**: Enhances the detection capabilities of the existing isolation mechanism. * **V8 Sandbox**: Limits transient access to 64-bit pointers. * **MPK-based in-process isolation**: Places Worker heaps behind hardware-enforced protection keys. **Cloudflare** noted that modern x64 systems typically offer about 12 keys for this purpose. Their design combines these keys with the **V8 Sandbox** and a rotating memory layout to prevent nearby sandboxes from sharing a key. **Cloudflare's** September 2025 description further explained that random **MPK** assignment alone would trap approximately 92% of cross-isolate accesses due to the possibility of two isolates receiving the same key. The stricter rotating layout is employed to eliminate this gap for the covered in-sandbox threat model.