500 million users at risk of compromise via unpatched WinRAR bug