Despite Java update, security experts say bugs remain