--- title: So that’s why it’s free.. | daily.dev description: Russian hackers are exploiting multiple WinRAR vulnerabilities, including CVE-2025-8088, to attack businesses. The latest exploit uses alternative data streams... canonical: https://daily.dev/posts/so-that-s-why-it-s-free--svwfisqlx twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: So that’s why it’s free.. | daily.dev og:description: Russian hackers are exploiting multiple WinRAR vulnerabilities, including CVE-2025-8088, to attack businesses. The latest exploit uses alternative data streams... og:url: https://daily.dev/posts/so-that-s-why-it-s-free--svwfisqlx og:image: https://api.daily.dev/og/posts/svWFISQLx.png og:image:alt: So that’s why it’s free.. og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # So that’s why it’s free.. **[Low Level Learning](https://daily.dev/sources/lowlevellearning)** · 10 min read · 25 upvotes · 10 comments ## Summary Russian hackers are exploiting multiple WinRAR vulnerabilities, including CVE-2025-8088, to attack businesses. The latest exploit uses alternative data streams and directory traversal techniques to place malicious DLL files in system directories, allowing attackers to execute code when legitimate applications load. These logic-based vulnerabilities are easier to exploit than memory corruption bugs because they don't require complex memory manipulation, just crafted file structures with specific properties. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Community discussion Top comments from developers on daily.dev. **@nikolaypenev** · 7 upvotes > Windows problem **@limbojunkie** · 2 upvotes > At first I thought WinRAR deliberately leaves backdoors. **@jack\_starborn** · 2 upvotes > 7-zip FTW :-) **@blvckwinter** · 2 upvotes > Windows itself is a bug **@nubprogrammer** · 0 upvotes > gotta replace it --- Tags: [#cyber](https://daily.dev/tags/cyber), [#malware](https://daily.dev/tags/malware), [#vulnerability](https://daily.dev/tags/vulnerability) [View this post on daily.dev](https://daily.dev/posts/so-that-s-why-it-s-free--svwfisqlx) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"So that’s why it’s free..","url":"https://daily.dev/posts/so-that-s-why-it-s-free--svwfisqlx","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/so-that-s-why-it-s-free--svwfisqlx"},"datePublished":"2025-08-15T15:13:17.811Z","dateModified":"2025-08-15T15:13:36.622Z","description":"Russian hackers are exploiting multiple WinRAR vulnerabilities, including CVE-2025-8088, to attack businesses. The latest exploit uses alternative data streams...","image":"https://i.ytimg.com/vi/H5r_Sg87ivM/sddefault.jpg","thumbnailUrl":"https://i.ytimg.com/vi/H5r_Sg87ivM/sddefault.jpg","isAccessibleForFree":true,"articleSection":"Low Level Learning","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Low Level Learning","logo":"https://media.daily.dev/image/upload/s--pjLyMMmx--/f_auto/v1724394406/logos/lowlevellearning","url":"https://daily.dev/sources/lowlevellearning"},"commentCount":10,"discussionUrl":"https://daily.dev/posts/so-that-s-why-it-s-free--svwfisqlx","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":25},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":10}],"keywords":"cyber,malware,vulnerability","timeRequired":"PT10M","video":{"@type":"VideoObject","name":"So that’s why it’s free..","description":"Russian hackers are exploiting multiple WinRAR vulnerabilities, including CVE-2025-8088, to attack businesses. The latest exploit uses alternative data streams...","thumbnailUrl":"https://i.ytimg.com/vi/H5r_Sg87ivM/sddefault.jpg","uploadDate":"2025-08-15T15:13:17.811Z","duration":"PT10M","url":"https://api.daily.dev/r/svWFISQLx","embedUrl":"https://www.youtube.com/embed/H5r_Sg87ivM"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Low Level Learning","item":"https://daily.dev/sources/lowlevellearning"},{"@type":"ListItem","position":3,"name":"So that’s why it’s free.."}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/so-that-s-why-it-s-free--svwfisqlx","comment":[{"@type":"Comment","text":"Windows problem","datePublished":"2025-08-25T11:45:09.304Z","url":"https://daily.dev/posts/svWFISQLx#c-zCAIUPNgP","author":{"@type":"Person","name":"NikolayPenev","url":"https://daily.dev/nikolaypenev","image":"https://media.daily.dev/image/upload/s--I61eMlIb--/f_auto/v1722502493/avatars/avatar_AGWOR6BGkieIvLkGCuY04"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":7}},{"@type":"Comment","text":"At first I thought WinRAR deliberately leaves backdoors.","datePublished":"2025-08-29T15:10:37.320Z","url":"https://daily.dev/posts/svWFISQLx#c-mvNhCZqgP","author":{"@type":"Person","name":"Sam","url":"https://daily.dev/limbojunkie","image":"https://lh3.googleusercontent.com/a/ACg8ocJtYuJrFvx0EEGn8HjNaevjuG7SOMdXYclWxIElBNjDukkipowy=s96-c"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2}},{"@type":"Comment","text":"7-zip FTW :-)","datePublished":"2025-09-02T07:25:27.211Z","url":"https://daily.dev/posts/svWFISQLx#c-KcSLADs4W","author":{"@type":"Person","name":"Jack Starborn","url":"https://daily.dev/jack_starborn","image":"https://media.daily.dev/image/upload/s--O0TOmw4y--/f_auto/v1715772965/public/noProfile"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2}},{"@type":"Comment","text":"Windows itself is a bug","datePublished":"2025-09-06T10:12:23.833Z","url":"https://daily.dev/posts/svWFISQLx#c-h80C4Tgpv","author":{"@type":"Person","name":"Blvck Winter","url":"https://daily.dev/blvckwinter","image":"https://lh3.googleusercontent.com/a/ACg8ocK_9KM3E1XRwr4YE5sdSCny_OWrUvoOfrQR_GRVaUfoKNQBhpw=s96-c"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2}},{"@type":"Comment","text":"gotta replace it","datePublished":"2025-09-04T14:21:58.875Z","url":"https://daily.dev/posts/svWFISQLx#c-tIR8tgGWN","author":{"@type":"Person","name":"Atharv","url":"https://daily.dev/nubprogrammer","image":"https://media.daily.dev/image/upload/s--iKAhtmCU--/f_auto/v1760698008/avatars/avatar_EP7yoOu1w1OjIXSXdNYQq?_a=BAMAK+ZW0"}}]} ```