Cloudflare proves remote Spectre attacks against Workers, 12 bits/s leak
Cloudflare found a hole in its Dynamic Process Isolation and demonstrated a remote Spectre attack against its Workers production environment, reliably leaking up to 12 bits per second at 99% accuracy. The fix is already shipped: an improved DyPrIs plus the V8 Sandbox with in-process isolation. The team says it found no signs of active exploitation in three years, but the published paper is a reminder that speculative execution remains a cross-tenant risk even under coarse-grained timers and noisy shared hardware.