And the company followed that revelation with the discovery of yet another critical bug in the program.

FORBES: Forget Oracle's Latest Java Patch. Just Kill The Program In Your Browser For Good

And because of the program's complexity, even the best produce their share of bug-ridden software.

ECONOMIST: Can Toshiba��s David topple Sony��s Goliath?

And before that bug could be patched, another critical security flaw in the program appeared.

FORBES: Apple Kills Java In Macs' Browsers After A Slew Of Security Vulnerabilities

Pax says the worm hides his XSS bug to make it harder to detect and patch, and he hopes to sell the program for close to a thousand euros.

FORBES: Updated with a more detailed statement from Yahoo! below.