That was a while ago when I last time worked with Java, so I might be
missing some recent security development. Any way:

Having a simple applet with hardcoded params it runs just fine on the
latest Java Plug-in 1.6.0_04 in both IE and Fx. If I put params into
PARAM tags then on getParameter it gives me SecurityException and
"Applet notinited" - the orthography is from plugin makers - in the
browser status bar. Is PARAM usage for applet is now locked? How do
workaround it then?

The applet in question is as simple as:

import java.awt.*;
import java.applet.*;
import java.net.*;

public class SockeR extends Applet {

public void init() {
 this.setBackground(
  // this works just fine, applet gets red:
  Color.red
  // using this instead of the above leads to error:
  //Color.getColor(this.getParameter("bgcolor"), Color.white)
 );
}

public void start() {
}

public void stop() {
}

public void destroy() {
}

public void paint(Graphics g) {
}

public String getAppletInfo() {
}
}