Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

From what I know, the HeartBleed bug seems to occur around 15 hours ago. As per, the HeartBleed bug was independently discovered by a team of security engineers at Codenomicon.

How did the public came to know about the news?

Where is the first online reference to the "HeartBleed" bug?

share|improve this question
Is knowing the first online reference helping you solve a problem? Or is this just a trivia question? – Byte56 Apr 8 '14 at 16:16
There is some ongoing debate on the Cloudflare blog about whether responsible disclosure was adhered to for this vulnerability. Maybe that is at the root of this question. – scuzzy-delta Apr 8 '14 at 16:22
@Byte56, Is how the vulnerability info disseminated not a security question? – Pacerier Apr 8 '14 at 16:23
up vote 4 down vote accepted

Hackernews user eastdakota (probably Matthew Prince) is the CEO and co-founder of CloudFlare (according to the HN bio) and has publicly stated that:

One of the individuals who discovered the [Heartbleed] bug contacted us as a large provider of SSL termination services. We were asked not to further disclose the details until it was officially patched and announced by OpenSSL. The official announcement occurred today after which we put up a post to let our customers know that they were protected.


...we held the post informing our customers that they were protected from the bug until after it was officially announced by the organizations that had discovered it as well as by OpenSSL

And also:

The bug was discovered by a researcher at Google and three engineers at Codenomicon.


The vulnerability was first reported to OpenSSL by Neel Mehta from Google Security. Matti Kamunen, Antti Karjalainen and Riku Hietamäki from Codenomicon Oy reported the vulnerability to NCSC-FI, who reported it in turn to OpenSSL. NCSC-FI would like to thank Codenomicon for reporting and analysing the vulnerability.

The site is registered to Codenomicon

Registrar URL:
Registrant Name: Marko Laakso
Registrant Organization: Codenomicon Oy

So going from what Matthew has said, it appears that the first public disclosure was either the OpenSSL Security Advisory or, and the rest is history.

The Cloudflare blog post is 21 hours old at the present time, with the Hackernews post now at 20 hours old, so the initial announcements from OpenSSL / are probably not much older than that.

Edit: now states:

OpenSSL Security Advisory (published 7th of April 2014, ~17:30 UTC)
Cloudflare Blog Entry (published 7th of April 2014, ~18:00 UTC) (published 7th of April 2014, ~19:00 UTC)

share|improve this answer

I was first alerted to this site Monday at 17:55 EST through a security discussion group. The site has numerous references to info about the bug.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.