In 2013, a serious Java flaw caused trouble for Oracle. CVE-2013-5838 grabbed a severity rating of 9.3 out of 10 on the CVSS, and with good reason — researchers from Polish firm Security Explorations (SE) discovered that it was possible to escape Java’s security sandbox and compromise the integrity, availability and confidentiality of an infected computer. Oracle evaluated the problem and quickly issued a patch.

That’s all she wrote, right? Not quite. According to CIO, the same security firm has discovered that the patch is now broken, and CVE-2013-5838 is set to boil over again.

Breaking Out: Not So Hard for a Java Flaw

Ideally, Java installations are protected by the Java Runtime Environment (JRE), which executes all code inside a virtual machine with strict security controls. It makes sense: By keeping code away from a PC or network at large, it’s possible to detect and deflect problem programs rather than cleaning up the mess after they infect a system. But what happens if attackers break out of the virtual sandbox? Suddenly, they’ve got free run of the entire computer and — if they’ve done their job right — no one’s the wiser.

It’s no wonder that this Java flaw got big attention and a quick patch when first discovered, but as noted by a Seclists post from Adam Gowdiak of Security Explorations, JDK 7 Update 40 from September 2013 is no longer working. In fact, he noted it can be “trivially bypassed” in only two steps.

First, a four-character alteration must be made to SE’s original proof-of-concept code, along with a custom server that enforces a “404 Not Found” error when requesting a specific class for the first time. The result? Potential cybercriminals once again have total access to compromised systems through the Java environment.

Don’t Hate the Player?

Java isn’t the only app code under threat. As noted by Ars Technica, Adobe just released an emergency patch for Flash Player to address over 20 critical vulnerabilities, including CVE-2016-1010, which allows actors to remotely execute malware using an integer overflow vulnerability. ZDNet, meanwhile, recently covered CVE-2016-0034, a Microsoft Silverlight vulnerability tucked into the popular Angler exploit kit.

Ultimately, the Ars Technica piece recommended trashing any Java, Flash or Silverlight extensions and applets unless they’re absolutely necessary. The ubiquity of these technologies makes them prime targets for cybercriminals; if they can poke holes in the virtual sandbox, they’re free to roam around at will, stealing data and executing malicious code.

While this kind of slash-and-burn PC protection may seem more like cutting off a nose to spite the face, it’s worth taking a hard look at any browser-based runtime environment. As the recent Java flaw makes crystal clear, everything old is new (and dangerous) again.