Remote Spectre Attack on Cloudflare Workers Leaks JWT at 12 Bits/Second

Cybersecurity researchers have disclosed details of a remote Spectre attack against Cloudflare Workers that leaked a JSON Web Token (JWT) from a co-located Worker in the production environment at up to 12 bits per second, 360 times the rate of an earlier attack demonstrated in 2021. The end-to-end experiment used an attacker Worker and a victim Worker controlled by the researchers, both operating within Cloudflare's production environment. The attack exploits speculative execution side effects to leak information across the isolation boundary between co-located Workers. The leaked JWT could potentially compromise authentication mechanisms if exploited maliciously. The demonstration confirms that Spectre-type side-channel attacks remain viable in modern cloud isolation architectures, even against major platform providers like Cloudflare. The researchers noted the attack's feasibility but did not release detailed exploit methodology. Cloudflare has been notified of the findings. No specific patch or mitigation was mentioned in the report; the incident highlights the ongoing challenge of securing speculative execution side effects in multi-tenant cloud environments.