Zero-day in file-sharing software leads to RCE, and attacks are ongoing