A week ago Sun (the makers of the Java platform) told a Google researcher (Tavis Ormandy) that it did not consider a known exploit to be serious enough to patch.

Ormandy said:
Sun has been informed about this vulnerability, however, they informed me they do not consider this vulnerability to be of high enough priority to break their quarterly patch cycle.

For various reasons, I explained that I did did not agree, and intended to publish advice to temporarily disable the affected control until a solution is available.

However, in an unexpected turn about, Sun released a patch for this exploit once reports started coming in that users were being infected by drive-by, in-the-wild Java attacks.
The flaw which was discovered independently, occurs because the Java-Plugin Browser is running “javaws.exe” without validating command-line parameters. To protect yourself and your clients from it, update to the most recent version of Java here.