AI Weekly Malaysia

Security researchers demonstrated a remote Spectre attack on Cloudflare Workers that leaked a JWT from a co-located Worker at 12 bits/second, 360x faster than a 2021 proof-of-concept. The attack exploited V8 isolate co-location within the same OS process, using WebSocket traffic as a remote timing source and Durable Objects to keep an isolate alive for 5-20+ hours, bypassing Cloudflare's Dynamic Process Isolation before it could trigger. Cloudflare reports the attack is now mitigated via V8 Sandbox integration and Memory Protection Keys, with no evidence of active exploitation in three years.

Why: If you ship on Cloudflare Workers with Durable Objects or WebSockets, this reveals that language-level V8 isolation is not equivalent to process isolation, and that long-lived Durable Object invocations created a window where DyPrIS never fired. The mitigations are deployed, but the architectural tradeoff—shared-process multi-tenancy for low startup latency—remains inherent to the platform. Review whether sensitive tokens like JWTs belong in Worker memory at all, and consider whether your threat model accounts for co-tenant side-channel risk on edge platforms that use isolate-based isolation rather than full process boundaries.