Google issues Chrome security update, ICC targeted by new attack, Microsoft nixes Authenticator password management

Summary

Cyber Security Headlines – July 2, 2025

Host: Sarah Lane
Podcast: CISO Series – Cyber Security Headlines
Release Date: July 2, 2025

---

1. Google Issues Critical Chrome Security Update

Timestamp: [00:06]

Google has swiftly addressed a significant security threat by patching a zero-day vulnerability in its Chrome browser. The flaw, identified as a type confusion issue in the V8 JavaScript engine, was actively exploited in the wild, allowing attackers to execute arbitrary code through malicious HTML content.

Sarah Lane reports, “Google has patched a zero day vulnerability in Chrome, a type confusion flaw in the V8 JavaScript engine that was actively exploited in the wild.” This incident marks Chrome’s fourth zero-day fix in 2025, highlighting the persistent challenges in maintaining browser security. The vulnerability was promptly discovered and mitigated by Google's Threat Analysis Group, ensuring protection across all platforms.

---

2. International Criminal Court (ICC) Targeted by Sophisticated Cyber Attack

Timestamp: [00:22]

The International Criminal Court (ICC) has fallen victim to a new, sophisticated cyber attack. While the precise motives behind the attack remain unclear, the ICC acknowledged the breach and confirmed that it was quickly contained, with an ongoing impact analysis underway.

Sarah Lane states, “The court didn't specify the attacker's motives or confirm if sensitive case data was compromised, but did note the breach was quickly contained with an ongoing impact analysis.” This incident follows previous cyber threats against the ICC, including espionage attempts and retaliatory actions related to the court’s issuance of arrest warrants against leaders from non-member states such as Russia and Israel.

---

3. Massive Data Breaches Impacting Millions

a. Kelly Benefitt Data Breach

Timestamp: [01:00]

Kelly Benefitt, a prominent health insurance provider, has confirmed a data breach that occurred in December 2024. Initially estimated to affect 32,000 individuals, the breach ultimately impacted 553,660 people. Compromised data includes names, Social Security numbers, medical and health insurance information, and, in some cases, financial account details.

“This breach impacted 46 affiliated organizations, including major insurers like United Healthcare and Aetna,” explains Sarah Lane. Affected individuals are being offered 12 months of free credit monitoring and identity theft protection to mitigate potential fallout.

b. S Health Data Breach

Timestamp: [03:15]

In related news, S Health, a major physician group based in St. Louis, Missouri, is notifying over 263,000 patients about a cyber attack that occurred in April. The breach resulted in the theft of personal and health data, including names, dates of birth, health insurance information, and medical record numbers. Fortunately, no Social Security numbers were compromised, and no group has claimed responsibility for the attack to date.

Sarah Lane summarizes, “Affected patients are being offered free identity protection through IDX,” ensuring that those impacted receive necessary support and protection against potential misuse of their personal information.

---

4. Microsoft Eliminates Password Management from Authenticator App

Timestamp: [04:20]

In a strategic move towards a passwordless ecosystem, Microsoft announced that starting August 1, 2025, it will remove password management features from its Authenticator app. This change includes the cessation of autofill support by the end of July and the removal of saved passwords from the app thereafter. However, users will still be able to manage their passwords through Microsoft Edge.

Sarah Lane highlights, “Going forward, the change doesn't affect Passkey functionality,” indicating that Microsoft is continuing to support more secure authentication methods. This shift underscores the broader industry trend away from traditional password-based security towards more advanced, passwordless solutions.

---

5. AT&T Launches Account Lock Feature to Prevent SIM Swapping Attacks

Timestamp: [05:10]

In an effort to enhance account security, AT&T has introduced a new account lock feature designed to prevent SIM swapping attacks. This feature blocks unauthorized changes to phone numbers, SIM cards, billing details, and device upgrades. Users can easily enable or disable this security measure through the My, AT&T app, with access restricted to primary or secondary account holders.

Sarah Lane notes, “Other carriers like Verizon and T-Mobile already offer similar protections,” positioning AT&T's new feature as a competitive enhancement in the mobile security landscape.

---

6. Cyber Attack on Russian Independent Media Linked to US-Sanctioned Institute

Timestamp: [05:50]

Researchers have uncovered that a recent DDoS attack targeting Russian independent media outlets Istories and Verstka is connected to Biterika, a Russian hosting provider associated with a US-sanctioned state tech institute. Approximately one third of the attack traffic originated from Biterika, whose owner, Valentina Alishina, has documented ties to military software development.

Sarah Lane reports, “One third of the attack traffic reportedly came from Biterika, whose owner Valentina Alishina, has ties to military software development,” suggesting a possible state-sponsored dimension to the cyber assault on independent media.

---

7. New Flaw in Integrated Development Environments (IDEs) Allows Malicious Extensions

Timestamp: [06:25]

A newly discovered vulnerability in popular IDEs like Visual Studio Code and IntelliJ IDEA allows malicious extensions to bypass the verification process. These compromised plugins can appear as verified, enabling them to execute harmful code on developers' machines.

Sarah Lane explains, “The exploit relies on mimicking metadata from trusted extensions to bypass verification, posing serious risks, especially for developers and installing extensions from unofficial sources.” Despite Microsoft's assurances that its marketplace blocks such extensions, the vulnerability remained exploitable as of late June, emphasizing the need for rigorous security practices when managing IDE plugins.

---

8. Cloudflare Implements Default Block on AI Web Scraping

Timestamp: [06:55]

In an effort to protect original content and establish a more equitable economic model, Cloudflare has announced that it will block AI web crawlers by default. This policy requires AI companies to obtain explicit permission from website owners before scraping content for training large language models (LLMs).

Sarah Lane summarizes, “Cloudflare says the shift gives creators control and promotes responsible AI development, though its impact may be limited on major social platforms that also develop their own LLMs.” This move aims to prevent unauthorized content scraping and ensure that creators are fairly compensated for their work.

---

Feedback and Engagement

Sarah Lane closes the episode by inviting listeners to share their thoughts and feedback: “If you have some thoughts on the news from today or about the show in general, be sure to reach out to [e-mail]. We would love to hear from you.”

---

Stay Informed: For daily cybersecurity stories and in-depth analyses, visit CISOseries.com.

---

End of Summary

Transcript

[A]

From the CISO series. It's Cybersecurity Headlines.

[B]

These are the cybersecurity headlines for Wednesday, July 2, 2025. I'm Sarah Lane. Chrome zero day under active Attack Google Issues Security Update Google has patched a zero day vulnerability in Chrome, a type confusion flaw in the V8 JavaScript engine that was actively exploited in the wild. The bug allowed attackers to execute arbitrary code via malicious HTML, prompting a swift mitigation push to all platforms discovered by Google's Threat Analysis Group. The flaw marks Chrome's fourth zero day fix of 2025. International Criminal Court Targeted by new sophisticated Attack the International Criminal Court, or icc, says it detected a new, sophisticated and targeted cyber attack last week. The court didn't specify the attacker's motives or confirm if sensitive case data was compromised, but did note the breach was quickly contained with an ongoing impact analysis. The ICC has faced prior cyber threats, including espionage attempts and direct retaliation for issuing arrest warrants against leaders from non member states such as Russia and Israel. Kelly Benefitt says 2024 data breach impacts 5,550,000 customers s health says recent data breach affects more than 263,000 patients Kelly benefits confirmed a data breach from December of 2024 that ultimately affected 553,660 individuals that is way up from an initial estimate of 32,000. The compromised data includes names, Social Security numbers, name medical and health insurance information, and in some cases, financial account details. The breach impacted 46 affiliated organizations, including major insurers like United Healthcare and Aetna, and affected individuals are being offered 12 months of free credit monitoring and identity theft protection. In related news, S Health, a major physician group in St. Louis, Missouri, is notifying more than 263,000 patients that their personal and health data was stolen during a cyber attack back in April. The breach disrupted patient facing systems and let attackers access and infiltrate files containing names, dates of birth, health insurance information and medical record numbers. No Social Security numbers were compromised and no group has claimed responsibility at this point. Affected patients are being offered free identity protection through IDX. Microsoft removes password management from authenticator app Starting August 2025 Microsoft will remove password management features from its authenticator app starting August 1st as part of a broader shift towards a passwordless ecosystem. Autofill support will end this month and saved passwords will no longer be accessible in the app after August, although users can manage them through Microsoft Edge. Going forward, the change doesn't affect Passkey functionality. Huge thanks to our sponsor Palo Alto Networks, you're moving fast in the cloud and so are attackers. But while SecOps and Cloud Security teams are are working in silos, attackers are exploiting the gaps between them. Cortex Cloud by Palo Alto Networks bridges this divide, unifying teams and stopping attacks with real time cloud security that includes AI powered protection, detection and automated response capabilities. Threats are stopped in minutes instead of days, and teams can finally protect cloud environments at the speed and scale of modern attacks. To learn more about how Cortex Cloud stops cloud attacks before the become breaches, visit the URL palo alto networks.com CDR that's Palo Alto networks.com CDR ATT now lets you lock down your account to prevent SIM swapping attacks. AT and T has launched a new account lock feature to help prevent sim swapping attacks by blocking unauthorized changes to phone numbers, SIM cards, billing details and device upgrades. Users can enable or disable the feature using the My, AT&T app, and only primary or secondary account holders have access. Other carriers like Verizon and T Mobile already offer similar protections. Cyber attack on Russian independent media had links to US sanctioned institute, researchers find Researchers say a recent DDoS attack on Russian independent media outlets Istories and Verstka was linked to Biterika, a Russian hosting provider tied to a US Sanctioned state tech institute. One third of the attack traffic reportedly came from Biterika, whose owner Valentina Alishina, has ties to military software development. New flaw in IDEs like Visual Studio code lets malicious extensions bypass verified status Researchers have discovered that popular IDEs like Visual Studio Code and IntelliJ Idea contain flaws in their extension verification process, allowing malicious plugins to appear verified and then execute code on developer machines. The exploit relies on mimicking metadata from trusted extensions to bypass verification, posing serious risks, especially for developers and installing extensions from unofficial sources. Microsoft says its marketplace blocks such extensions, but the vulnerability was still found exploitable as of late June. Cloudflare puts a default block on AI web scraping Cloudflare will now block AI web crawlers by default, requiring explicit permission from website owners before allowing content to be scraped for training large language models. The move is designed to protect original content and establish a more equitable economic model, as AI companies have previously scraped content without consent or compensation. Cloudflare says the shift gives creators control and promotes responsible AI development, though its impact may be limited on major social platforms that also develop their own LLMs. If you have some thoughts on the news from today or about the show in general, be sure to reach out to [e-mail] we would love to hear from you. I am Sarah Lane reporting for the CISO series and we'll talk to you next time.

[A]

Cybersecurity headlines are available every weekday. Head to cisoseries.com for the full stories. Behind the headlines. Boom.