Hims Breach Exposes the Most Sensitive Kinds of PHI

This DarkReading roundup highlights multiple high-risk incidents and trends: a Hims telehealth breach exposing sensitive PHI; active exploitation of a FortiClient authentication bypass (CVE-2026-35616) with an emergency patch; a Windows local-privilege zero-day PoC release (BlueHammer); Storm-1175’s fast Medusa ransomware campaigns leveraging n-day and zero-day flaws; automated credential-harvesting attacks against exposed Next.js apps (React2Shell exploitation); AI-assisted supply-chain and exploit development activity targeting GitHub and open-source maintainers; and nation-state/APT attacks