Security Fix for Critical Java Flaw Released
Summary: Oracle released emergency, out-of-schedule updates to close a critical Java 7 flaw that attackers were actively exploiting to plant malware on users who merely browsed to a hacked or malicious site. The patches bring Java 7 to Update 7 and Java 6 to Update 35, and Security Explorations says it alerted Oracle to this vulnerability and 30 others back in April, with it unclear how many were fixed in this release.
Bottom line: The exploit in the wild worked against Windows, Mac and Linux systems running Java 7 Updates 1 through 6, and Oracle had not planned another security update until October despite being told of 31 flaws in April.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026