Loading…
A revisit of remote Spectre attacks on Cloudflare Workers
CloudflareMartin Schwarzl
Summary
Cloudflare reassessed remote Spectre attack feasibility within Cloudflare Workers production workloads to evaluate defenses against modern stabilization techniques. The experimental proof of concept bypassed Dynamic Process Isolation (DyPrIs) by keeping invocations alive using WebSocket traffic, which also diluted hardware performance counter ratios below detection thresholds. By combining branch mistraining, cache line eviction, and speculative type confusion, researchers transiently accessed out-of-bounds memory via raw 64-bit TypedArray backing store pointers. This attack demonstrated cross-tenant data leakage reaching up to 12 bit/s with over 99% accuracy in production. In response, Cloudflare mitigated the vulnerability by integrating the V8 memory sandbox, deploying Memory Protection Keys for hardware-assisted in-process isolation, and redesigning DyPrIs to monitor active long-lived executions.
Context
Cloudflare Workers isolates thousands of tenants inside shared operating-system processes using V8 isolates. Although mitigations such as restricted timers, disabled multithreading, and Dynamic Process Isolation (DyPrIs) were deployed, advancements in remote Spectre exploitation raised concerns that attackers could bypass defenses and achieve cross-tenant memory disclosure.
Approach / What changed
Cloudflare evaluated an updated remote Spectre proof of concept using speculative type confusion against raw 64-bit TypedArray backing store pointers. After identifying detection blind spots in DyPrIs, Cloudflare deployed the V8 sandbox, introduced Memory Protection Keys (MPK) to restrict cross-isolate memory access in hardware, and updated DyPrIs to evaluate long-lived executions.
Takeaways
- The experimental remote Spectre attack leaked data in production at up to 12 bit/s with greater than 99% accuracy despite restricted local timers and CPU load.
- WebSocket keep-alive messages maintained open Worker invocations for hours, evading post-invocation DyPrIs isolation and inflating iTLB activity to mask branch misprediction ratios.
- Cloudflare hardened the runtime by implementing the V8 sandbox, hardware-enforced memory isolation using Memory Protection Keys, and real-time DyPrIs monitoring for active workloads.
Related reading
Unveiling good and bad behaviors on the Agentic Internet
Web traffic increasingly shifts between human interaction and automated agents, rendering point-in-time security checks ineffective against sophisticated automation. Cloudflare addresses this shift through continuous behavioral analysis designed to evaluate trust across entire user sessions rather than relying on static point-in-time hurdles. Its CDN-injected client-side system, Precursor, tracks continuous behavioral indicators like cursor movements to catch mid-session automated takeovers. To counter rapid bot adaptation, Cloudflare is introducing self-adjusting machine learning models under Adaptive Intelligence and non-deterministic defenses such as the AI Labyrinth. These tools allow site owners to poison scraper training data, trap crawlers in synthetic webs, or queue legitimate agents while dynamically penalizing abusive traffic.
Jin-Hee LeeCloudflare DDoS Threat Report H1 2026: 1 Tbps attacks soar as DNS floods and geopolitical tensions drive a new wave
In the first half of 2026, network-layer DDoS attacks exceeding 1 Tbps surged by 519% quarter-over-quarter, with 935 mitigated attacks recorded across the period. Threat actors shifted their focus toward reflection and amplification methods, making DNS-based floods and CLDAP floods the dominant vectors. Despite the rise in hyper-volumetric traffic, 96.62% of network-layer attacks remained under 500 Mbps and 90.60% ended in under 10 minutes. Geopolitical conflicts and international events heavily influenced target selection, pushing the Media, Production & Publishing industry to the top position. Because brief multi-gigabit bursts trigger downstream routing instability and application timeouts before analysts can respond, automated, always-on edge mitigation has become critical.
Cloudforce OneBGP Role model: tracking the adoption of RFC 9234
Border Gateway Protocol route leaks occur when routing announcements propagate beyond their intended customer-provider or peer relationships, causing traffic misdirection and performance degradation. RFC 9234 embeds relationship awareness directly into BGP by establishing negotiated BGP Roles and attaching an Only to Customer (OTC) transitive path attribute to prevent unauthorized route propagation. To assess real-world adoption, Cloudflare monitored OTC attribute transmission across peer networks and discovered that 33.1 percent of IPv4 and 17 percent of IPv6 paths were missing the OTC attribute. Investigation revealed that Tier-1 transit providers AS1299 and AS3257 were stripping the attribute due to legacy defensive BGP error-handling configurations. Following direct engagement, AS1299 updated its configurations to preserve OTC propagation, whereas AS3257 continued stripping it, highlighting the necessity of broader vendor and carrier support across the Internet.
Bryton HerdesThe Cloudflare Blog – Brought to you by EmDash
Cloudflare migrated its official blog to EmDash, an Astro-focused content management system, acting as internal Customer Zero to evaluate scaling and usability. To prepare for traffic spikes reaching thousands of requests per second, engineers used k6 to execute ramp, breakpoint, and burst load tests. The resulting production architecture runs EmDash on Cloudflare Workers, pairing it with Workers Cache, an object cache backed by Workers KV, and Hyperdrive connected to PlanetScale. This layered caching design serves 99.5 percent of static files and 70 percent of requests from cache, flattening p95 latency under real-world loads reaching 850 requests per second. The migration also introduced a frontend redesign using the Kumo design system and added Model Context Protocol servers for automated agent workflows.
Kody Jackson