WinRAR Zero-Day CVE-2025-8088 Exploited to Spread RomCom Malware

WinRAR suffered a critical path-traversal vulnerability (CVE-2025-8088) that was actively exploited by a Russia-linked cyberespionage group to deliver the RomCom backdoor through crafted archive attachments in phishing emails; ESET researchers disclosed the abuse and WinRAR released version 7.13 to fix the flaw, but users must manually install the update to remain protected.