New Java Exploit Fetches $5,000 Per Buyer
Summary: Less than 24 hours after Oracle patched a Java flaw used to seize control of Windows PCs, an administrator of an exclusive cybercrime forum posted a sales thread offering a new Java 7 Update 11 zero-day to two buyers at $5,000 each, promising unencrypted source files and a weaponized version not present in any known exploit kit. KrebsOnSecurity later updated the story to report the sales thread was an elaborate hoax by the forum administrator designed to learn the screen name the reporter was using to browse the forum's exclusive sections.
Why it matters: The episode shows how quickly criminal markets react to a patch, and how a single forum administrator can use a $5,000 sales pitch as a pretext to unmask a journalist - a reminder that what you see in an underground thread may be a trap aimed at someone other than a buyer.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026