InfoSecBulletin Cybersecurity for mankind
A serious security flaw in WinRAR, a popular file compression tool for Windows, is being exploited by attackers to gain unauthorized access to systems. CVE-2025-8088 is a vulnerability that lets attackers insert harmful files into sensitive system folders unnoticed, giving them control over Windows computers.
The security flaw was first exploited in July 2025 and still poses a risk to millions, even though a patch has been available since July 30, 2025.
Hackers deploy Casbaneiro Trojan that activates on bank websites
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
Palo Alto PAN-OS Flaw Enables Root Arbitrary Code Execution
Critical Check Point VPN flaws allow remote code execution attacks
Cisco confirms CVE-2026-20079 flaw in Secure FMC is exploited in attacks
Hackers exploit PaperCut flaws using hundreds of AI agents, compromising 440 servers globally
CISA Says Chinese Firms Extracted Billions of Tokens From Frontier AI Models
Nightmare Eclipse Drops New Microsoft Defender ‘ShieldCrash’ zero-day
cPanel Flaw Lets Hosting Accounts With Mail Privileges Execute Code as Root
The flaw has drawn interest from various attackers, including government-backed espionage groups from Russia and China, as well as financially motivated criminals targeting global businesses.
These adversaries exploit vulnerabilities to spread malware, steal login information, and maintain access to hacked systems. The attack uses specially designed RAR files to exploit a path traversal vulnerability, letting files be written to any location on victim computers.
Google Cloud researchers found that this vulnerability is being widely exploited in campaigns against Ukrainian military and government bodies, as well as technology, hospitality, and banking sectors.
Researchers found that attackers exploit a flaw to place malicious files in the Windows Startup folder, making the malware run every time the victim logs in. This method is similar to the tactic used in a prior WinRAR vulnerability (CVE-2023-38831) in 2023, showing how attackers take advantage of unpatched software.
This vulnerability’s quick spread shows that effective defense needs prompt patching and a shift to identifying consistent post-exploitation tactics.
