{"rewrite":{"id":"r_4dfa446542c3a28a025fa114","clusterId":"c_b29bd69e35e68fd7bbb6b300","slug":"cloudflare-reproduces-remote-spectre-attack-on-workers-reads-data-at-12-bits-per-second","model":"deepseek-v4-flash:free","headline":"Cloudflare Reproduces Remote Spectre Attack on Workers, Reads Data at 12 Bits per Second","summary":"Cloudflare reproduced a remote Spectre attack in its production Workers environment, reading JWT tokens from another Worker with over 99% accuracy at up to 12 bits per second. The attack used a network-based timer and PLRU cache amplification to overcome the lack of an internal high-precision clock. The techniques have already been mitigated.","whyItMatters":"The successful reproduction shows that Cloudflare's existing countermeasures, including DyPrIs and disabled multithreading, were insufficient against a remote timer that amplifies cache timing differences over the network.","webCardHtml":"\u003cp\u003eCloudflare\u0026#39;s security team ran the attack between two Workers it controls in production, targeting JWT tokens stored in the victim Worker\u0026#39;s memory. The readout reached 12 bits per second with over 99% accuracy, a major jump from the 120 bits per hour ceiling of earlier remote timer research from 2021.\u003c/p\u003e\u003cp\u003eThe key advance was using the Pseudo Least Recently Used mechanism to amplify the few-nanosecond difference between cache hits and misses into a signal large enough to survive network latency. The team then used a remote timer over WebSocket as the clock, since Workers deliberately freeze time during CPU processing.\u003c/p\u003e\u003cp\u003eCloudflare states the attack techniques used in the research have already been mitigated in production.\u003c/p\u003e","blueskyPost":"Cloudflare reproduced a remote Spectre attack in production Workers, reading JWT tokens at 12 bits/sec with 99% accuracy. The trick: PLRU cache amplification plus a network timer. Mitigations are already in place.","twitterPost":"Cloudflare ran a remote Spectre attack in production Workers and read JWT tokens at up to 12 bits/sec with 99% accuracy. PLRU amplification made the cache signal visible over network latency. Already mitigated.","threadsPost":null,"newsletterBlurb":"Cloudflare reproduced a remote Spectre attack in its production Workers environment, reading JWT tokens from another Worker at up to 12 bits per second with over 99% accuracy. The team used PLRU cache amplification and a network-based timer to overcome the lack of an internal high-precision clock. The techniques have already been mitigated.","attributionJson":"[{\"source\":\"GIGAZINE\",\"url\":\"https://gigazine.net/news/20260820-cloudflare-remote-spectre/\",\"title\":\"Cloudflare Successfully Executes Remote Spectre Attack, Reading Confidential Information from Workers at Up to 12 Bits per Second\"}]","lintFlagsJson":null,"lintHits":0,"costUsd":0,"inputTokens":4586,"outputTokens":571,"status":"published","repairAttempts":0,"nextRepairAt":null,"factsAttemptedAt":1787211742,"createdAt":"2026-08-20T07:35:21.000Z","publishedAt":"2026-08-20T07:36:44.000Z","updatedAt":"2026-08-20T07:35:21.000Z"},"cluster":{"id":"c_b29bd69e35e68fd7bbb6b300","canonicalTitle":"CloudflareがリモートSpectre攻撃に成功、Workersから機密情報を最大12bit/秒で読み出す","representativeArticleId":"a_a39d3be661a8d70cd1b1e170","sourceCount":1,"writtenSourceCount":1,"writeAttempts":0,"isSolo":true,"entitiesJson":"{\"anime_titles\":[],\"manga_titles\":[],\"work_titles\":[],\"studios\":[],\"people\":[],\"type\":\"news\",\"domain\":\"other\",\"is_roundup\":false}","contentType":"news","status":"published","firstSeenAt":"2026-08-20T03:35:00.000Z","lastSeenAt":"2026-08-20T03:35:00.000Z","updatedAt":"2026-08-20T07:36:44.000Z"},"attribution":[{"source":"GIGAZINE","url":"https://gigazine.net/news/20260820-cloudflare-remote-spectre/","title":"CloudflareがリモートSpectre攻撃に成功、Workersから機密情報を最大12bit/秒で読み出す"}],"entities":{"anime_titles":[],"manga_titles":[],"work_titles":[],"studios":[],"people":[],"type":"news","domain":"other","is_roundup":false},"keyFacts":null}