> This happened last month, so it was 0-day THEN, not NOW. Yes - Facebook made it clear they were exploited prior to the patch getting out. == SNIP == The com

> This happened last month, so it was 0-day THEN, not NOW. Yes - Facebook made it clear they were exploited prior to the patch getting out. == SNIP == The compromised website hosted an exploit which then allowed malware to be installed on these employee laptops. The laptops were fully-patched and running up-to-date anti-virus software. ... After analyzing the compromised website where the attack originated, we found it was using a "zero-day" (previously unseen) exploit to bypass the Java sandbox (built-in protections) to install the malware. We immediately reported the exploit to Oracle, and they confirmed our findings and provided a patch on February 1, 2013, that addresses this vulnerability. == SNIP == The difference between zero-day and not, is that if you are attacked by an exploit that your vendor hasn't seen (and presumably has no patch available for) - you are particularly vulnerable. Once a CVE has been assigned, then your platform/software vendors are now more "on the hook" for any exploits that occur after that date. Two indications of a security conscious company: 1. They have a very short period of time before the CVE identification and their patch (hopefully automatically) rolled out. 2. They announce security vulnerabilities inline with a patch - thereby reducing the number of zero day exploits. Microsoft, in particular, has been very aggressive in announcing security exploits, and rolling out patches in the last 12-18 months - Adobe and Oracle could learn a lot from them. > So far the latest fixes (in browsers and in Java) seem to have been effective. Unless you have a very specific reason (SSL VPN, Enterprise App, perhaps a youtube video, or specific application) - you should no longer be running plugins in your browser. I've been running with Safari and all plugins disabled for about 14 months, switching to Chrome for youtube videos has been about the the only inconvenience. The last exploit in flash/java/pdf/xxx may have been fixed, but you can certain there will be more in the next few months.