CLOUDFLARE WORKERS SPECTRE ATTACK LEAKS JWT FROM CO-LOCATED WORKER AT 12 BITS/SECOND

Summary from the TLDR InfoSec newsletter

Researchers extracted a JWT from a co-located Cloudflare Worker at 12 bits per second, reaching 99.16% accuracy. The attack used WebSockets for remote timing and Durable Objects to keep code running. WebSocket I/O reduced DyPrIs detection signals. Cloudflare deployed improved DyPrIs, V8 Sandbox protections, and MPK-based isolation and confirmed no customer data was accessed or active exploitation.