Security firm FireEye reports that cyber criminals are exploiting previously unknown vulnerabilities in the current Java versions to deploy malware. The hole allows attackers to access the memory of the Java Virtual Machine (JVM). There, the exploit will look, for example, for the area that determines whether Java's Security Manager is active, and it will then try to overwrite this area with a zero. The Security Manager controls which system resources can be accessed by the code running in the JVM; once it is disabled, the exploit is free to execute the downloaded malware.

The FireEye researchers say that the discovered exploit isn't very reliable because it will try to overwrite large memory data blocks; however, it is likely only a matter of time before the approach is perfected. The hole is found both in Java version 7 update 15 and in version 6 update 41. The version 6 branch is no longer actively maintained by Oracle.

To protect themselves, users can completely uninstall Java or at least disable it in their browser. Another useful option is the click-to-play feature in Firefox and Chrome; which, when enabled, will require explicit user approval before a plugin can be executed. Talking to The H's associates at heise Security, researcher Adam Gowdiak confirmed that the exploited vulnerability is not one of the flaws he recently discovered and reported to Oracle.