Security patches from Oracle haven't significantly reduced the hacking threat from Java, the Department of Homeland Security says in warning that users should keep it disabled for now. "Unless it is absolutely necessary to run Java in web browsers, disable it," a Web post by the department's Computer Emergency Readiness Team says.