WinRAR flaw lets hackers run programs when you open RAR archives

Can someone explain why WinRar installers of the same exact versions and languages but downloaded from their different sites www.rarlab.com vs www.win-rar.com have different sizes/hashes while being signed by the same signer?

Reminder that 7z can extract .rar files, and is open source!

Thanks for the heads-up.