A critical zero-day vulnerability in Cleo file-transfer software is under active exploitation, about six weeks after the company issued an advisory for a previously disclosed CVE, researchers said ...