Hmm...more reason for me to hate Java than I already do.
Not surprising Oracle didn't announce this right away. They inherited it from Sun when they bought them, so they probably A) didn't bother to check and, therefore, didn't know about it right away and/or B) don't feel like they have as much ownership over it as, say, their database software, much in the way they treated PeopleSoft right after purchasing them (still don't know why they did that - I worked with PeopleSoft for 3 years and it was pure shit). Either way, I don't think would look good to their shareholders, so there may have been wishful thinking on their part that it would have gone undiscovered if they had known about it all along.
I am surprised that DHS found this, though, and not some kind of independent IT watchdog group. But since there is a veritable ass-ton of stuff written in Java everywhere, particularly within gov't circles, they probably felt it was worthy of a second, unbiased look. Surprise!
So glad this bird is finally coming home to roost. I hated Java when I first experienced it back in the 90's and I still think it's an over-engineered monstrosity.