For some software systems with high availability requirements, it is not acceptable to have the system shut down when a new version of it is to be deployed. An alternative is to use unanticipated runtime software evolution, which means making changes to the software system while it is executing. We propose a classification of unanticipated runtime software changes. Our classification consists of a code change aspect, a state change aspect and an activity aspect. The purpose of the classification is to get a greater understanding of the nature of such changes, and to facilitate an abstract view of them. We also present results from a case study, where historical changes to an existing software system have been categorized according to the classification. The data from the case study gives an indication that the Java Platform Debugger Architecture, a standard mechanism in Java virtual machines, is a viable technical foundation for runtime software evolution systems.