'Critical flaw in Java's Spring Framework has so far hit 16% firms globally'