300k vulnerable to Heartbleed two months later
When the Heartbleed vulnerability was announced, we found 600k systems vulnerable. A month later, we found that half had been patched, and only 300k were vulnerable. Last night, now slightly over two months after Heartbleed, we scanned again …
Context & Ripple Effects
When OpenSSL's Heartbleed flaw was disclosed on April 7, Errata Security counted roughly 600k exposed systems and began tracking remediation with repeat internet-wide scans. By its one-month follow-up in May the count had halved to 300k, matching Sucuri's April finding that even high-profile sites — 0.52% of the top 10K — were still unpatched weeks after disclosure.
The June 22 scan is the third data point in that series, and it matters because the number did not move: two months out, the vulnerable population sits at the same 300k as the one-month mark. The story has shifted from a mass-patching sprint to a stubborn residual tail that headline coverage alone evidently cannot reach — which is why TechCrunch, The Verge, Gizmodo and Neowin all picked up the update.
First-order effects
- Operators of the ~300k still-vulnerable servers remain directly readable by anyone on the internet via the memory-disclosure bug, despite two months of public warning and free remediation guidance.
- Certificate authorities and site owners who revoked keys during the initial scramble face continued exposure risk wherever the underlying server was patched without regenerating credentials, since revocation only helps if the endpoint itself gets fixed.
Second-order effects
- Security vendors and managed hosting providers gain a concrete sales argument against self-managed servers: the scan series shows unpatched long-tail hosts persisting at scale, pushing buyers toward providers who apply updates automatically.
- OpenSSL's volunteer maintainers face sustained pressure over the project's under-resourcing, since a vulnerability this old in such widely deployed code became a referendum on who funds critical internet plumbing.
Third-order effects
- If the pattern holds, mass-disclosure events converge on an irreducible laggard population within weeks — implying that disclosure-driven urgency alone cannot close the last mile, and that default-on automatic updating becomes the structural fix regulators and platform vendors push next.
- Repeated independent scans like Errata's establish external measurement as standard practice for judging whether the industry actually remediates, shifting accountability from vendor advisories toward verifiable fleet-wide data.
The trend: Internet-wide vulnerability response is splitting into a fast first wave of patches followed by a persistent unmanaged tail, making continuous external scanning rather than disclosure-day panic the real measure of security posture.