Serious Java flaw discovered