A Revisit of Remote Spectre Attacks on Cloudflare Workers
Cloudflare, Wednesday, August 19th, 2026
Cloudflare reassesses remote Spectre attacks against Workers, covering new gadgets, remote timers and co-location techniques.
Cloudflare published a reassessment of remote Spectre attacks against its Workers infrastructure, covering work done in 2024 and 2025.
The company first assessed such attacks in 2021 and shipped a production defense called Dynamic Process Isolation, which identifies suspicious-looking scripts and isolates them into separate processes.
The new post details fresh attack primitives, including Spectre gadgets and remote timing techniques.
It also covers how an attacker can achieve co-location with a target Worker, a prerequisite for the attack. Cloudflare describes the additional defenses it has since deployed to harden Workers further.