In April 2014, a critical flaw in OpenSSL. CVE-2014-0160. Exposed passwords, session tokens, and even private encryption keys from vulnerable servers worldwide. Here’s what Heartbleed is, how it works, and what you should do right now.