Oracle Sunday released a security update that addresses two critical zero-day vulnerabilities in Java that are being actively exploited by attackers. Less than 24 hours later, an online vulnerability seller began offering a brand-new Java bug for sale. The exploit is valuable because not only is it usable on the most up-to-date version of Java, which could remain vulnerable for weeks, if not months. The most recent hold Java fixed allowed hackers to enter a computer by using compromised websites as the entry-point into Java.
Source: https://thehackernews.com/2013/01/new-java-exploit-sells-for-5000-on.html