This question already has an answer here:
One thing that's been bugging me in relation to the discovery of the Heartbleed OpenSSL flaw is the recommendation that everyone should run to their computers in a panic and change all of their passwords right now. Considering that there probably still are sites out there that haven't yet upgraded their OpenSSL version to fix the issue, won't changing all your passwords just leave you vulnerable to having your new passwords stolen? This could be especially troublesome as people tend to reuse the same passwords across multiple sites.
In summary, my question is - how can users adequately protect themselves at this point in time?