--- title: "What You Should Know About Java’s Security Issues" id: "15481" type: "post" slug: "what-you-should-know-about-javas-security-issues" published_at: "2013-01-24T15:31:22+00:00" modified_at: "2026-11-09T19:02:38+00:00" url: "https://associationsnow.com/2013/01/24/what-you-should-know-about-javas-security-issues/" markdown_url: "https://associationsnow.com/2013/01/24/what-you-should-know-about-javas-security-issues.md" excerpt: "One of the most-widely used pieces of software in the world has struggled to shake off a wide array of security issues. If you use it, is it time to change platforms?" taxonomy_category: - "Ethics" taxonomy_post_tag: - "AssociationsNow" - "cybersecurity" - "Java" - "Software" - "Technology" taxonomy_content_format: - "Article" taxonomy_role: - "Association CEO / Executive Director" - "C-Level" - "Executive Team" - "VP" taxonomy_persona: - "Association Professionals" --- [Home](https://associationsnow.com/) » [Articles](https://associationsnow.com/format/article/) » What You Should Know About Java’s Security Issues Many computer users have a piece of software on their computers so insecure that the U.S. government has recommended it be disabled. > We still think it’s an issue you may as well confront now, instead of simply invoking ‘legacy reasons’ as an excuse for ignoring it for too long. The problem is, there’s a chance it may be essential for your association’s work. [As we reported last year (opens in a new tab)](http://associationsnow.com/2012/11/report-microsoft-software-security-improves-greatly/) , Java is one of the most insecure pieces of software in common use. Users have been forced to update their software 11 separate times over the past 18 months alone, according to ZDNet. **The current situation:** Recently, researchers [discovered a so-called zero-day vulnerability (opens in a new tab)](http://www.kb.cert.org/vuls/id/625617) with the Java platform, meaning that the security hole was already being used by hackers to access systems remotely on multiple platforms—including Windows, Linux, and Mac OSX. The vulnerability is so severe that the U.S. Department of Homeland Security [urged users to disable the software on their computers (opens in a new tab)](http://www.latimes.com/business/technology/la-fi-tn-java-disable-malware-department-oh-homeland-security-20130111,0,6103875.story) , and [Apple blocked Java (opens in a new tab)](http://www.macrumors.com/2013/01/11/apple-blocks-java-7-on-os-x-to-address-widespread-security-threat/) on the OSX platform altogether. While the flaw was patched, [researchers continued to find flaws (opens in a new tab)](http://www.informationweek.com/security/application-security/java-hacker-uncovers-two-flaws-in-latest/240146717) in the latest versions of the software. **Update headaches:** On top of Java’s security issues, users may find themselves in danger when looking to update. On Windows, [at least one piece of malware has been spotted (opens in a new tab)](http://reviews.cnet.com/8301-13727_7-57565035-263/beware-of-fake-java-updates/) pretending to be the Java update. And even if you get the real one, there are still significant issues—ZDNet’s Ed Bott [points out that Oracle’s Java installer (opens in a new tab)](http://www.zdnet.com/a-close-look-at-how-oracle-installs-deceptive-software-with-java-updates-7000010038/) on Windows, required for installing the security updates, includes a browser add-on for the search engine Ask.com that’s turned on by default and is difficult to remove once installed. **Security experts frustrated:** How bad is the situation with Java? At least one security researcher argues that Java may need a complete rethinking. “Oracle should just take a mulligan and redesign Java before everyone completely loses faith in it, and those concerns leak over onto every Oracle product,” [Andrew Storms of nCircle Security told ComputerWorld (opens in a new tab)](http://www.computerworld.com/s/article/9235997/Experts_prod_Oracle_to_fix_broken_Java_security) . **The problem for businesses:** While Java is not as widely used by consumers, it is a common platform for web-based and desktop-based business applications, especially those that have to work cross-platform. Naked Security, the blog run by security firm Sophos, notes that the site’s recommendation that Java should be shut off entirely has led to a bit of backlash from readers. While accepting that a transition like this is difficult to handle, the company’s Paul Ducklin suggests that the Java crisis may be an excuse to move corporate software to a new, more secure platform. “We still think it’s an issue you may as well confront now, instead of simply invoking ‘legacy reasons’ as an excuse for ignoring it for too long, as many companies did with IE 6,” [he explained recently (opens in a new tab)](http://nakedsecurity.sophos.com/2013/01/20/java-hacker-boasts-of-finding-two-more-unpatched-holes/) . Does your association use Java-based software to run its internal applications? If so, have you considered moving to something else because of security concerns? (Oracle) [Ernie Smith](https://associationsnow.com/author/ernie-smith/) Ernie Smith is a former senior editor for Associations Now. [More articles by this author](https://associationsnow.com/author/ernie-smith/) Tags: [#cybersecurity](https://associationsnow.com/tag/cybersecurity/) [#Java](https://associationsnow.com/tag/java/) [#Software](https://associationsnow.com/tag/software/) [#Technology](https://associationsnow.com/tag/technology/) **Stay Informed** [Subscribe to our free newsletter](https://associationsnow.com/newsletter/) , *Associations Now Daily News*, to find out what’s happening in the association world every business day. ## You Might Like - [PodcastSecuring Identity: What Associations Need to Know About Verifiable CredentialsJune 25, 2025](https://associationsnow.com/2025/06/25/securing-identity-what-associations-need-to-know-about-verifiable-credentials/) - [PodcastAssociations Now Presents: Beyond the Tech Stack: How AI Is Changing the Association PlaybookOctober 29, 2026](https://associationsnow.com/2026/10/29/associations-now-presents-beyond-the-tech-stack-how-ai-is-changing-the-association-playbook/) - [TemplateMembers onlyMember Onboarding ToolkitNovember 5, 2026](https://associationsnow.com/2026/11/05/member-onboarding-toolkit/) - [VideoThe Career Moves Every Association Leader Needs Right NowSeptember 24, 2026](https://associationsnow.com/2026/09/24/the-career-moves-every-association-leader-needs-right-now/) ## Comments **Comments are for ASAE members.** [Learn more about comments on this site.](https://associationsnow.com/comments/) [Log in](https://associationsnow.com/login?redirect_to=https%3A%2F%2Fassociationsnow.com%2F2013%2F01%2F24%2Fwhat-you-should-know-about-javas-security-issues%2F%23comments) to your member account or [join ASAE](https://my.asaecenter.org/select-a-membership-type/) !