[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fMMqgQMMYl7kLQlMmWCk0a8bR4UDjiDG1dXycdsCwOvU":3},{"article":4,"iocs":47,"watch_terms":55,"solutions":56,"lesson":151},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":29,"category":30,"article_tags":34},"5b7f544e-60b8-4057-9700-066c8bba13f7","Cloudflare Workers Spectre Attack Leaks JWT From Co-Located Worker at 12 Bits\u002FSecond","cloudflare-workers-spectre-attack-leaks-jwt-from-co-located-worker-at-12-bits-se-ef4c1d","Cybersecurity researchers have disclosed details of a remote Spectre attack against Cloudflare Workers that leaked a JSON Web Token (JWT) from a co-located Worker in the production environment at up to 12 bits per second, 360 times the rate of an earlier attack demonstrated in 2021. The end-to-end experiment used an attacker Worker and a victim Worker controlled by the researchers,","Cybersecurity researchers have detailed a remote Spectre attack against Cloudflare Workers that successfully leaked a JWT from a co-located Worker at a rate of 12 bits per second. The attack, which leveraged weaknesses in Cloudflare's Dynamic Process Isolation (DyPrIs) and V8 Sandbox, demonstrated a significant speed increase compared to previous attacks. Cloudflare has since implemented several mitigations, including improved DyPrIs, V8 Sandbox integration, and Memory Protection Keys, and reports no indicators of active exploitation.","Spectre attack leaks JWT from Cloudflare Worker at 12 bits\u002Fsec.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F08\u002Fcloudflare-workers-spectre-attack-leaks.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEi50HcHSWt796lc8zQ8Anp_fHUqgV-BM0xiS1NxJW8zRDgBRJ9ovZOECiIhdQt0aVTUdhduJYP1o5wTa5RpDoCwhihq8rKqWmh73E9E8UzafyDcq1n1khCEIDCikK2L6NEt1mbIuMRm6F36bap74JtZawFqqCPvWF72SAm25BzREVerWYaRIDEo1O89V4k\u002Fs1600\u002Fjwt.jpg","2026-08-19T19:02:40+00:00","2026-08-19T20:00:17.610894+00:00",8,[17,20,23,25,27],{"name":18,"type":19},"Cloudflare Workers","product",{"name":21,"type":22},"Spectre","technology",{"name":24,"type":22},"JWT",{"name":26,"type":22},"V8 Sandbox",{"name":28,"type":22},"DyPrIs","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":29,"icon":31,"name":32,"slug":33},null,"Vulnerabilities","vulnerabilities",[35,37,42],{"category":36},{"id":29,"icon":31,"name":32,"slug":33},{"category":38},{"id":39,"icon":31,"name":40,"slug":41},"c70f3a41-2f0c-4608-870d-b8cbcd8be076","Cloud Security","cloud-security",{"category":43},{"id":44,"icon":31,"name":45,"slug":46},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[48,52],{"type":49,"value":50,"context":51},"mitre_attack","T1055.012","Process Injection: Process Hollowing (related to memory leakage)",{"type":49,"value":53,"context":54},"T1496","Resource Hijacking (potential for co-located worker exploitation)",[18],{"controls":57,"vendors":144},[58,87,116],{"slug":59,"name":60,"problem":61,"products":62},"breach-attack-simulation","Breach and attack simulation","You only find out whether your security tools stop an attack when a real attacker tries.",[63,71,79],{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"safebreach","SafeBreach","\u002Fvendor-logos\u002Fsafebreach.png","safebreach-propagate","SafeBreach Propagate","https:\u002F\u002Fwww.safebreach.com\u002Fpropagate-attack-path-validation\u002F","Automated penetration testing that emulates lateral movement, privilege escalation and credential harvesting to show how far a breach could spread.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"picus-security","Picus Security","\u002Fvendor-logos\u002Fpicus-security.png","picus-breach-and-attack-simulation","Picus Breach and Attack Simulation","https:\u002F\u002Fwww.picussecurity.com\u002Fplatform\u002Fbreach-and-attack-simulation","Continuously tests live defences against current threats, shows what controls block, detect, log and miss, and provides ready-to-apply fixes.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"attackiq","AttackIQ","\u002Fvendor-logos\u002Fattackiq.png","attackiq-flex","AttackIQ Flex","https:\u002F\u002Fwww.attackiq.com\u002Fproducts\u002Fflex\u002F","Agentless, on-demand testing of security controls without deploying the full platform.",{"slug":88,"name":89,"problem":90,"products":91},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[92,100,108],{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"slug":46,"name":117,"problem":118,"products":119},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[120,128,136],{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":140,"product_name":141,"url":142,"description":143},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",[145],{"slug":146,"name":147,"logo_path":148,"roles":149},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png",[150],"affected",{"slug":152,"title":153,"body":154,"framework_refs":155,"framework_notes":166},"spectre-side-channel-attack-leaks-secrets-from-cloudflare-workers-via-shared-process-isolation-weakn","Spectre Side-Channel Attack Leaks Secrets from Cloudflare Workers via Shared Process Isolation Weaknesses","Researchers demonstrated a remote Spectre-class side-channel attack against Cloudflare Workers that exploited weaknesses in Dynamic Process Isolation (DyPrIs) and the V8 sandbox, successfully extracting a JWT token from a co-located worker at 12 bits\u002Fsecond — a significant improvement over prior benchmarks. The root cause lies in insufficient hardware-level memory isolation between tenant workloads sharing the same physical infrastructure, a systemic risk in multi-tenant edge compute environments. This matters because sensitive tokens, credentials, and cryptographic material processed in shared environments can be exfiltrated without any traditional exploit, leaving no obvious indicators of compromise. Cloud providers and developers alike must treat speculative execution vulnerabilities as an ongoing architectural threat, not a one-time patch event.",[156,157,158,159,160,161,162,163,164,165],"CIS Control 7: Continuous Vulnerability Management","CIS Control 4: Secure Configuration of Enterprise Assets and Software","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 SC-39: Process Isolation","NIST SP 800-53 SC-28: Protection of Information at Rest\u002FIn Use","NIST SP 800-57: Key Management Recommendations","MITRE ATT&CK T1212: Exploitation for Credential Access","MITRE ATT&CK T1600: Weaken Encryption \u002F Side-Channel","OWASP Cloud Security: Tenant Isolation Controls","ISO\u002FIEC 27001 A.12.6.1: Management of Technical Vulnerabilities",{}]