Public Java Exploit Amps Up Threat Level
Summary: An exploit for a recently disclosed Java vulnerability that had been sold in the criminal underground has been added to the open source Metasploit framework, and researchers tested it to deliver payloads on current Windows, Mac and Linux systems. Microsoft's Tim Rains reported that between one-third and one-half of all exploits observed each quarter from 3Q10 through 2Q11 targeted Java, averaging 6.9 million exploit attempts per quarter and nearly 27.5 million for the year.
Bottom line: Oracle says more than three billion devices run Java, and the flaw is cross-platform, unpatched on some systems, and exploits the user with little visible sign - while one enterprise commenter reported that rolling out the patched Update 29 broke web applications and forced a rollback, leaving machines sitting vulnerable.
Read the original at Krebs on Security ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026