From what I know, the HeartBleed bug seems to occur around 15 hours ago. As per heartbleed.com, the HeartBleed bug was independently discovered by a team of security engineers at Codenomicon.
How did the public came to know about the news?
Where is the first online reference to the "HeartBleed" bug?
Hackernews user eastdakota (probably Matthew Prince) is the CEO and co-founder of CloudFlare (according to the HN bio) and has publicly stated that:
One of the individuals who discovered the [Heartbleed] bug contacted us as a large provider of SSL termination services. We were asked not to further disclose the details until it was officially patched and announced by OpenSSL. The official announcement occurred today after which we put up a post to let our customers know that they were protected.
And:
...we held the post informing our customers that they were protected from the bug until after it was officially announced by the organizations that had discovered it as well as by OpenSSL
And also:
The bug was discovered by a researcher at Google and three engineers at Codenomicon.
The vulnerability was first reported to OpenSSL by Neel Mehta from Google Security. Matti Kamunen, Antti Karjalainen and Riku Hietamäki from Codenomicon Oy reported the vulnerability to NCSC-FI, who reported it in turn to OpenSSL. NCSC-FI would like to thank Codenomicon for reporting and analysing the vulnerability.
The heartbleed.com site is registered to Codenomicon
Domain Name: HEARTBLEED.COM
Registrar URL: http://www.godaddy.com
Registrant Name: Marko Laakso
Registrant Organization: Codenomicon Oy
So going from what Matthew has said, it appears that the first public disclosure was either the OpenSSL Security Advisory or heartbleed.com, and the rest is history.
The Cloudflare blog post is 21 hours old at the present time, with the Hackernews post now at 20 hours old, so the initial announcements from OpenSSL / heartbleed.com are probably not much older than that.
Edit: heartbleed.com now states:
OpenSSL Security Advisory (published 7th of April 2014, ~17:30 UTC)
Cloudflare Blog Entry (published 7th of April 2014, ~18:00 UTC)
heartbleed.com (published 7th of April 2014, ~19:00 UTC)
I was first alerted to this site Monday at 17:55 EST through a security discussion group. http://heartbleed.com/ The site has numerous references to info about the bug.
