Oracle Knew About Currently Exploited Java Vulnerabilities for Months, Researcher Says
Oracle knew since April about the existence of the two unpatched Java 7 vulnerabilities that are currently being exploited in malware attacks, according to Adam Gowdiak, the founder and CEO of Polish security firm Security Explorations.
Context & Ripple Effects
Adam Gowdiak of Security Explorations says Oracle has known since April that two Java 7 vulnerabilities were exploitable, yet left them unpatched into late August while malware attacks using them spread — a claim picked up the same week by Computerworld, The Register, Ars Technica, Krebs on Security and at least four other outlets, giving it unusual reach for a single researcher's disclosure.
The technical detail sharpening the story: per the confirmed findings, the exploit runs in Safari and Firefox on Macs running Mountain Lion, though no attacks targeting Mac users were known at the time. It lands on an Oracle already fighting publicly over Java — months earlier a jury had rejected its patent claims against Google over the platform.
First-order effects
- Anyone running the Java 7 browser plug-in is exposed right now to malware exploiting two flaws Oracle has reportedly known about since April, with no vendor fix available.
- Oracle faces immediate reputational pressure over its patch cadence: a four-month gap between knowledge and remediation, documented by a named researcher, invites scrutiny of how it prioritizes Java fixes.
Second-order effects
- Corporate IT and security teams are pushed toward disabling or removing the Java browser plug-in where business applications allow it, shrinking the audience for Java applets independent of anything Oracle ships.
- Other researchers and firms, seeing Security Explorations' disclosure gain traction across eight-plus outlets, have incentive to publicize unpatched Oracle flaws rather than wait for quiet fixes — raising the cost of slow patching.
Third-order effects
- If vendors holding widely deployed runtimes leave known-exploited flaws open for months, the industry norm shifts toward out-of-band emergency patches and public researcher disclosure as the enforcement mechanism, rather than scheduled patch cycles alone.
- Browser-embedded plugins like Java become a structurally disfavored attack surface, accelerating the move toward sandboxed or plugin-free web runtimes as enterprises weigh convenience against exposure.
The trend: Java is consolidating as a prime malware delivery vector, with researcher disclosures and active exploits forcing runtime vendors to compress patch timelines they once controlled.