Oracle fixed a number of critical security flaws in Java with the latest update, but it's still too slow to patch and attackers will continue to take advantage.