Java zero-day exploit goes mainstream, 100+ sites serve malware