Daily Cyber & AI Briefing — 2026-04-03

Daily Cyber & AI Briefing with Michael Housch. This episode was published automatically and includes the assembled audio plus full transcript.TranscriptWelcome to today’s cyber and AI risk briefing. I’m Michael Housch, and over the next fifteen minutes, I’ll walk you through the most significant developments shaping the risk landscape right now. We’re seeing a surge in high-impact cyber incidents, a rapidly evolving threat environment, and growing pressure on organizations to rethink how they manage both cyber and AI risks. Let’s dive in.Let’s start with a story that’s sending shockwaves through the AI industry: the recent breach at Mercor, an AI-driven recruiting platform. Attackers managed to exfiltrate a staggering four terabytes of sensitive data. To put that in perspective, that’s millions of files—potentially including resumes, employment records, proprietary algorithms, and communications between employers and candidates. This isn’t just a headline; it’s a wake-up call for any organization leveraging AI platforms to handle large volumes of personal or business-critical information.The Mercor breach underscores three core issues. First, the sheer scale of data managed by AI platforms means a single breach can have outsized consequences. Second, many organizations still treat their AI vendors as black boxes, assuming security is someone else’s problem. And third, incident response plans often don’t account for the unique data flows and integration points that AI services introduce. If your business is using AI-driven tools—whether for recruiting, analytics, or customer service—now is the time to revisit your vendor due diligence, ensure you have clear contractual security requirements, and rehearse your incident response playbook with these new realities in mind.Unfortunately, Mercor isn’t alone. Another incident making headlines involves a money-transfer application that exposed customer passport images for nearly five years. The cause? Sensitive documents were stored on an unencrypted, publicly accessible cloud server. This isn’t a sophisticated attack; it’s a basic misconfiguration—a mistake that left highly sensitive identity documents open to anyone who knew where to look. The implications are severe: not only does this create a goldmine for identity thieves, but it also puts the company at risk of regulatory penalties, lawsuits, and lasting reputational damage.What’s the lesson here? Cloud security is not a “set it and forget it” proposition. Even mature organizations can fall victim to simple mistakes—especially when cloud environments are complex, and responsibilities are split between internal teams and third-party vendors. Regular cloud security assessments, strict access controls, and continuous monitoring are not optional. They’re essential for protecting both your business and your customers.Shifting gears, let’s talk about a vulnerability that’s being actively exploited right now: React2Shell. Attackers are leveraging this flaw to compromise over 700 Next.js hosts in a large-scale credential harvesting campaign. For those less familiar, Next.js is a popular web framework used by thousands of organizations to build modern applications. The React2Shell vulnerability allows attackers to execute malicious code and steal user credentials, often before defenders even know what’s happening.This campaign highlights the speed at which attackers weaponize new vulnerabilities. Within days of the flaw being disclosed, threat actors had automated their attacks and were targeting organizations at scale. If your organization uses Next.js or related frameworks, it’s critical to prioritize patching, monitor for indicators of compromise, and review your application security practices. This isn’t just about one vulnerability—it’s about building the muscle for rapid response as new threats emerge.On a related note, Google recently released an emergency patc