Cloudflare Workers Spectre Attack Leaks JWT From Co-Located Worker at 12 Bits/Second

Researchers demonstrated a remote Spectre-based side‑channel attack against Cloudflare Workers that can exfiltrate JWTs from co‑located isolates (up to ~12 bits/sec in tests). The paper details how long‑lived Durable Objects and WebSocket timing enable the attack, shows diminished detection under certain I/O patterns, and contrasts the new results with a prior 2021 proof; Cloudflare has deployed mitigations (improved DyPrIs, V8 Sandbox, MPK-based isolation) and reported no signs of active exploitation in production.