A different mitigation to just disabling SMT might be to just make sure SMT threads are all allocated to the same VPS of a cloud host? That way only code from the same client can be on the threads of the same core.
Most VPSs are two or more threads anyway these days, so it may already be done...