Incorrect. Even malware targeting write-once-run-anywhere systems is rarely write-once-run-anywhere itself. The actual shellcode of the exploit is almost alwa

Incorrect. Even malware targeting write-once-run-anywhere systems is rarely write-once-run-anywhere itself. The actual shellcode of the exploit is almost always native code, or a native binary dropped on the filesystem via a directory traversal bug. The attacker typically has to determine the system being attacked and use system-specific shellcode, even for system-independent vulnerabilities. The JIT or bytecode interpreter is rarely directly leveraged by the exploit code itself. In other words, the shellcode is almost never bytecode. Write once run anywhere isn't the problem. Write once run anywhere is just a feature that greatly increases the number of machines with a given piece of vulnerable software installed. VMs also tend to be big complicated pieces of software with a huge attack surface, and tend to be written in unsafe languages (C/C++). If 99% of all browsers used very similar versions of libpng, all with the same vulnerability, we'd see this same problem. Software monoculture combined with poor incentives to write secure software is the problem. Edit: since write-once-run-anywhere languages tend to be more safe, it's a shame that more VMs aren't written in (subsets of) their hosted languages. Jikes RVM, PyPy, and Squeak Smalltalk are some notable exceptions.