Lately, yes. Over the last couple of years (Read: after Microsoft mostly cleaned up its act), Java has been been one of the primary sources of client exploits,

Lately, yes. Over the last couple of years (Read: after Microsoft mostly cleaned up its act), Java has been been one of the primary sources of client exploits, along with Adobe products. I don't know that there's anything special wrong with it other than that anything deployed widely enough makes a good target. Edit: here's one sample article from last year: http://isc.sans.edu/diary.html?storyid=9916 http://isc.sans.edu/diary.html?storyid=9916