Software holes under attack