One month after the Heartbleed bug put Web security on notice, more than 300,000 servers worldwide are still vulnerable. That's the word from Errata Security's Robert Graham, who came to that number after scanning millions of Web servers on Internet port 443, which is used for TSL/SSL communication.
Graham's determination that 318,239 servers are still vulnerable to Heartbleed is a significant drop from the more than 600,000 he found when Heartbleed first became public.
Discovered in early April, Heartbleed is a devastating bug with the potential to reveal website encryption keys, usernames, passwords, and user data to attackers. The vulnerability was found in OpenSSL, a popular cryptographic tool designed to secure communications between a user's browser and a web server.
Read: The critical, widespread Heartbleed bug and you: How to keep your private info safe
But while Graham's numbers are concerning, they may not tell the entire story.
Graham said he could have scanned additional ports used for SSL communication, but focused only on the most common one, 443.
He also said he found 22 million systems with SSL support this time around, down from 28 million a month ago. That drop of 6 million systems, Graham theorises, may have been due to more systems detecting and blocking the scan for a Heartbleed vulnerability. Traffic congestion at Graham's ISP may have also been a factor.
If anything, it appears Graham's discovery of 300,000 vulnerable servers may be just the floor of potentially unpatched systems and not the roof.
Regardless, it's clear that many systems around the world still aren't patched to defend against the OpenSSL Heartbleed bug. And that may not change anytime soon.
A separate security research scan first reported by ArsTechnica found that in the past two weeks the number of unpatched servers dropped by just 0.44 percentage points. That slowing of patched servers suggests security updates for the Heartbleed bug have generally stopped, Vivaldi.net blogger yngve notes.
Read: Healing Heartbleed: Lastpass offers automated checker, major sites admit vulnerability
What's not clear, however, is exactly which sites and services are still vulnerable. Many large online companies have already taken great pains to let its users know they were not affected by the bug or that their servers are now protected against Heartbleed. So those vulnerable servers may be from from smaller online services and businesses, but that is by no means certain.
Despite its hassles, Heartbleed can also be credited with inspiring some benefits for the general health of the web. In late April, numerous large Internet companies partnered with the Linux Foundation to create the Core Infrastructure Initiative (CII). The CII is an industry group charged with providing funding for widely used, critical open source projects such as OpenSSL that are in desperate need of financing and support.