This is going to cause some grief!

I understand that this is a severe vulnerability but completely and compulsorily blocking the Java plugin is extreme. Many companies have internally developed Java applets to access databases and perform other functions. There are also games and other legitimate Java code out there. I understand that Apple probably would find it almost impossible to whitelist applets based on network source it's Oracle that needs to move!

I could be mistaken, but not all browsers comply with the XProtect thingee.

Article is not correct

They blocked the Java 7 *plugin*, not Java 7. That is a big difference. Java applications will still run on the Mac - just not in a browser. If they blocked Java 7, developers who work in Java (for example, web server back ends) would suddenly find they could no longer work on their Macs.

Thanks for pointing this out, the article has been revised to make that clearer.

Websites that require Java to run always inform the users that the plugin is required to view the content, so I don't see this as a big issue. By blocking it Apple makes sure that everything is safe for its users.

Java threat - do I really need to take action on my Mac?

What's the final word on this? Do I need to take action to protect my Mac?

Will Sophos antivirus software, which I have installed and updated, catch and eradicate this if I do stumble across it?

Java 6 is working

Java 6 is still working as a plugin in Safari on Lion 10.7.5. I had to go back to Java 6 after installing Java 7 on Tuesday and it freezing.
Java for OS X 2012-006: How to re-enable the Apple-provided Java SE 6 applet plug-in and Web Start functionality
BTW, I hate Java.

Jeff75. You should avoid accessing sites that use client side Java applets.
- How do you know if a site uses Java applets until you go there? You should make sure your Java security settings alert you to that. You get a warning that a site wants to put a client side applet on your machine.
- Will Sophos antivirus catch and eradicate "this" if I do stumble across it? That all depends on what "this" is. Between the time that a vulnerability is discovered and when the AntiVirus folk create a detection mechanism, there is a window of opportunity for your system to become compromised. In the event a known malware product leaves a detectable trace (specific actions, or specific files indicative of a compromise) your AntiVirus may well catch and block those specific actions, and/or eradicate the offending files (presuming your settings specify those AntiVirus remediation steps). The Java plugin vulnerability is typically an attack "vector", meaning, that's how they can get in. The damage is usually done by software the intruder installs after gaining access.
In short, yeah, maybe - or - almost certainly, eventually.

If you want to be as safe as you can, make sure your AV software, Java software, and browser plugins are up to date. Don't reduce security settings for expedience.

My 2 cents.