If you've got an old Java installer sitting in your downloads folder, delete it. Oracle announced old installers are vulnerable to binary planting.

Older Java installers are designed to look for and automatically load a number of specifically named DLL (Dynamic Link Library) files that might exist in the folder they were launched from.

On most computers, the default download folder quickly becomes a repository of old and unorganized files that were opened once and then forgotten about. A recently fixed flaw in the Java installer ...

For years, Oracle has tormented Windows users by bundling adware with its Java installer for Windows PCs. Now Oracle has begun including the same adware as part of a default installation of Java ...

When Computerworld ran the Java 8 installer, the Yahoo tool was also installed. It was unclear whether Yahoo’s toolbar also violated the new Microsoft rule. It appears it should.