Why the Heartbleed Bug Won't Go Away

Remember the Heartbleed bug? We told you in April about this dangerous vulnerability in OpenSSL, a cryptographic library that secures a huge amount of web traffic.

The vulnerability made international headlines for many days - with some calling it one of the largest threats ever to confront the internet. To refresh your memory, what made Heartbleed such a big deal was that it was present in OpenSSL, which is responsible for providing SSL and TLS encryption functionality. SSL and TLS enable web users to securely send sensitive information, such as passwords and credit cards. In a moment, the bug served as a reminder of the internet's inherent fragility and how a single defect could impact the world over.

But despite the mass awareness on the importance of websites patching vulnerable servers, a new report now says that nearly half of all affected servers - some 300,000 - remain open to the vulnerability. Of course, users can confidently assume that most, if not all, major banking and e-commerce sites with which they do business have updated against the vulnerability. Still, the Heartbleed exposure rate - more than two months later - is remarkably high.

We previously created a Heartbleed tester, where you can enter a URL and check to see if a site is vulnerable to the bug. Given this report, it's probably not a bad idea to the test a domain if, for example, it's a lesser known site with which you're planning to exchange personal information.

We also have answered frequently asked questions about the bug, which includes best practice suggestions for users and site owners.