Oracle Corp to fix Java security flaw “shortly”
(Reuters) - Oracle Corp said it is preparing an update to address a flaw in its widely used Java software after the U.S. Department of Homeland Security urged computer users to disable the program in web browsers because criminal hackers are exploiting a security bug to attack PCs.
Context & Ripple Effects
This is the second act of a story Oracle has been living since at least August 2012, when a researcher claimed the company had known about currently exploited Java vulnerabilities for months while leaving them unpatched. The flaw now drawing headlines has reportedly been open since an October 2012 fix failed to close it, and The Next Web reports it is being used to push ransomware onto PCs.
What changed on January 12 is who is reacting: the U.S. Department of Homeland Security took the unusual step of urging users to disable Java in web browsers outright, and Apple moved to block Java 7 on OS X. The story traveled widely the same day — Krebs on Security, The Verge, Engadget, VentureBeat, ABC News and MacRumors all picked it up — turning a routine patch promise into a public trust problem for Oracle.
First-order effects
- DHS's advisory makes disabling Java in browsers the default guidance for consumers and corporate IT desks, immediately shrinking the audience for Java applets until Oracle ships its promised update.
- Apple's decision to block Java 7 on OS X removes the plugin from Mac browsers regardless of what Oracle does, so Oracle loses control of its own remediation timeline on a major platform.
Second-order effects
- Enterprises running web applications that depend on Java applets face a forced tradeoff between breaking internal tools and leaving an actively exploited hole open — a cost Oracle does not bear directly but shapes through its patch cadence.
- With a researcher already on record in August 2012 saying Oracle sat on these exploits for months, every day between the DHS warning and the fix compounds reputational damage and invites competitors and security firms to frame Java as the unreliable runtime.
Third-order effects
- If government agencies and OS vendors keep stepping in ahead of the vendor, patching authority effectively shifts away from Oracle toward whoever controls the browser and the operating system — a structural loss for any plugin-based execution model.
- The episode strengthens the case for holding software makers accountable for known-exploited flaws left unfixed, a line of scrutiny that follows naturally from the documented months-long gap between disclosure and remediation.
The trend: Browser-embedded runtimes like Java are losing their default place on the web as governments and platform vendors act faster than the software vendor's own patch cycle when exploits go live.