If you haven't heard of the Heartbleed Bug, it's something to take a look at immediately. It essentially means that an attacker can exploit a vulnerability in many versions of OpenSSL to be able to gain access to a server's private key. It is not a theoretical threat, it is a demonstrable and reproducible threat. See the above link for more information.
The question I think most organizations are asking themselves is the following:
Does every company now need to create new public/private keypairs and ask their CA to invalidate the original signed keypairs?