Heartbleed is the name of a recently disclosed vulnerability in the widely used security software called OpenSSL, which is used for securing web communications.
What makes Heartbleed so venerable is the way it stays completely undetectable and is very easy to exploit. Cloudflare posted a challenge for people to extract the private key from their intentionally vulnerable server, and it was just a matter of time before someone managed to break it.
What makes this possible is the ability to send a malformed request to a TLS extension called heartbeat, which makes the server respond with arbitrary memory data up to 64k. It can contain anything, such as user passwords and even the private keys used to secure the connection in the first place.
xkcd provides probably the simplest way of explaining what the Heartbleed is all about in xkcd 1354.
If you are not running your own site, you won’t have to bother with patching the software and issuing new certificates. You will however need to change your password on affected sites, and Mashable provides a list of popular sites and their current status.
Bruce Schneier writes about Heartbleed and his post contain links for further reading and discussions and is well worth a browse.