New Java Attack Rolled Into Exploit Kits
Summary: A weaponized exploit for a critical Java flaw in Oracle Java SE JDK and JRE 7 and 6 Update 27 and earlier is being folded into automated attack tools, with Java 6 Update 29 and Java 7 Update 1 being the patched versions. The exploit, discussed in an exclusive cybercrime forum and demonstrated in a member's video, is being rolled into the BlackHole exploit kit, where it is free to existing license holders and $4,000 for others on top of a BlackHole license costing $700 for three months, $1,000 for six months, or $1,500 per year.
What you should know: A working Java exploit priced at $4,000 and bundled into one of the most widely deployed exploit kits turns any hacked website into a silent malware delivery point for users running anything older than the latest Java package, and the operators were observed pushing a Russian ransomware package that demanded 500 rubles within 12 hours.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026