New Spectre attack variants prompt Cloudflare security upgrades

Cloudflare has disclosed new research into Spectre attack variants targeting its Workers serverless computing platform, demonstrating a 12 bit/s data leakage with 99% accuracy in production. The company identified limitations in its existing Dynamic Process Isolation (DyPrIs) defense during internal testing in 2024-2025, prompting security upgrades including V8 Sandbox integration and enhanced process isolation. While the demonstrated attack has been mitigated in production and no active exploitation was found, the research highlights ongoing challenges in protecting shared cloud environments against speculative execution attacks. Cloudflare's technical blog details the attack primitives including Spectre gadgets and remote timers, along with its multi-layered security approach combining V8 isolates, Linux namespaces, and seccomp filters. The findings contribute to broader industry efforts to harden cloud infrastructure against increasingly sophisticated side-channel attacks.