An IdP advisory will be coming soon, possibly by the end of this week. It's a bit unusual and isn't accompanying a patch. It involves risks to non-current IdP versions (i.e. not 4.2) primarily when Java isn't patched. The immediate risk is (extremely) critical, but is much lower if Java isn't out of date. -- Scott