Anyone could recover the private keys for eight certificates. Firefox and Chrome blocked them on 17 October; Oracle and OpenJDK followed four days later. Oracle gave a Java flaw a score of 9.1 out of ...