Oracle's whack-a-mole with Java security follows a decade of technical debt. But why won't it turn to open source community for help?

The company’s annual Open Source Security and Risk Analysis report finds widespread use of open source components with high-risk vulnerabilities.