This story is odd. Perhaps it is pure click-bait? Why would an attack that depends on a vulnerability Microsoft fixed three years ago be successful or even attempted today?? And...if someone were running a machine without this MS patch, and presumably also without a browser that makes you perform handstands while singing "There's no business like show business" before it will run Java, then wouldn't they also be vulnerable to hundreds of other issues fixed in the past few years??