Nearly all computer programs have security flaws. But Java has a reputation for not quickly responding to potential issues, said Kurt Baumgartner, a senior security researcher at Kaspersky Labs. “They are very slow at handling problems,” he said.

Developers are moving away from Java in favor of other programs such as Adobe’s Flash, but Java remains a standard program for many kinds of business software. If the security concerns discourage developers from using the program, the move away from Java could accelerate, analysts said.

Oracle updates Java every four months, far less frequently than the monthly or even weekly updates other software gets. Researchers who report Java problems to Oracle often wait months for a fix. That was the case with a security problem the company patched in August — one that security researchers said they identified in April.

The long period of time between updates gives hackers time to take advantage of software problems, experts say.

Chester Wisniewski, a senior researcher at the security firm Sophos, said Java exploits accounted for about 90 percent of all Web-based attacks last year, or about 12,000 attacks a day. The problem Oracle addressed Sunday, he said, had already found its way into “exploit kits,” or ready-made code that hackers distribute and use to crack vulnerable sites.

Wisniewski said users should disable Java within their Web browsers for security reasons, and only enable it if they need it for a critical program.