FWIW, Yesterday I received an update from Java, that may have addressed the security issue.