Highly critical OpenSSL bug went unnoticed for more than two years