Urgent: WinRAR Zero-Day Exploits Enable Malware and Phishing Attacks
TL;DR
The WinRAR utility has released version 7.13 to fix a critical zero-day vulnerability (CVE-2025-8088) actively exploited in the wild, which could allow attackers to execute arbitrary code through malicious archive files. The vulnerability, related to path traversal, has been linked to recent attacks by threat groups like Paper Werewolf, targeting Russian organizations via phishing. Users are urged to update to the latest version immediately to mitigate risks.
- WinRAR Zero-Day Under Active Exploitation – Update to Latest Version Immediately The Hacker News
- WinRAR zero-day exploited to plant malware on archive extraction BleepingComputer
- Newly discovered WinRAR exploit linked to Russian hacking group, can plant backdoor malware — zero day hack requires manual update to fix Tom's Hardware
- Patch Now: New WinRAR Flaw Used to Deliver Malware PCMag
- Phishing attacks exploit WinRAR flaw CVE-2025-8088 to install RomCom Security Affairs
Want the full story? Read the original reporting
Read on The Hacker News