The bad guys certainly seem to be picking on Oracle in the last month or two.  The folks over at Fireeye have posted some info about another 0-day affecting Java that is being exploited in the wild.  This one hits even the latest versions of Java 6u41 and 7u15.  From the writeup the it seems the exploit is currently not always successful, but when it is drops a remote access trojan on the systme and connects back to an HTTP command and control server.  I haven't had a chance to actually look at the malware yet, so go read the Fireeye writeup for the indicators of compromise to look for in your network.  Simultaneously, Adam Gowdiak has also informed Oracle of 2 different exploitable vulnerabilities (though at least one of his only affects 7u15, not 6u41), though those exploits are apparently not be used in the wild at the moment.  In the meantime, all our previous advice still applies.  If you don't need Java, don't install it/remove it.  If you do need it, only enable it when you need it and/or run it inside another sandbox (SandboxIE, a sacrificial VM).

References:

http://blog.fireeye.com/research/2013/02/yaj0-yet-another-java-zero-day-2.html
http://www.zdnet.com/oracle-investigating-after-two-more-java-7-zero-day-flaws-found-7000011965/

https://isc.sans.edu/diary/When+Disabling+IE6+%28or+Java%2C+or+whatever%29+is+not+an+Option.../14947

---------------
Jim Clausing, GIAC GSE #26
jclausing --at-- isc [dot] sans (dot) edu