It seems like every other day we get a new article on Java problems, all written for non-technical readers. I know there are new 0day exploits appearing -- but

It seems like every other day we get a new article on Java problems, all written for non-technical readers. I know there are new 0day exploits appearing -- but I have no idea what's actually required to activate them. Oracle's oh-crap patch at the beginning of this recent PR mess was to force a user confirmation dialog for running any applet. Are the new exploits bypassing that as well, or are these situations where the sucker has to click "yes, I want to run this possible dangerous content" before bad things happen? It really does make a big difference, but none of the article authors seems to know or care about what actually happens for each exploit to work.