Low-level CPU security — Spectre, speculative execution, side channels — grounded in a real production system running untrusted code for tens of thousands of tenants. Jordan and Riley cover why Workers is uniquely exposed (untrusted JS in V8 isolates, tens of thousands of tenants sharing one OS process, so a single arbitrary read = cross-tenant leak), then how Cloudflare re-attacked their own production to test whether their 2021 defense (Dynamic Process Isolation) still holds against newer techniques. They walk the four hurdles the team had to clear to pull it off in prod: rebuilding a high-res timer over a WebSocket (Workers freezes local timers), a speculative type-confusion gadget that survived V8 pointer compression via a raw 64-bit backing-store pointer, signal amplification through a tree-PLRU L1 replacement trick, and cache reset by pigeonhole eviction. Result: a demonstrated remote Spectre leak up to 12 bit/s at 99% accuracy in production — already mitigated, no evidence of exploitation in 3 years. Fixes: hardened DyPrIs plus integrating the V8 Sandbox with in-process isolation to kill the raw-pointer gadget class. Lesson: Spectre isn't patch-once — periodically re-attack your own defenses under real production conditions. Source: A revisit of remote Spectre attacks on Cloudflare Workers — The Cloudflare Blog, Aug 19 2026 (paper: arXiv:2608.17043) — https://blog.cloudflare.com/revisiting-spectre-attacks-on-workers/ This is commentary/summary in the hosts' own words, not a reproduction of the article.