Dear readers, please change your Ars account passwords ASAP

For more than two years, the Internet's most popular implementation of the Transport Layer Security (TLS) protocol has contained a critical defect that allowed attackers to pluck passwords, authentication cookies, and other sensitive data out of the private server memory of websites. Ars was among the millions of sites using the OpenSSL library, and that means we too were bitten by this extraordinarily nasty bug.

By mid-morning Tuesday, Ars engineers already updated OpenSSL and revoked and replaced our site's old TLS certificate. That effectively plugged the hole created by the vulnerability. By installing the OpenSSL update, attackers could no longer siphon sensitive data out of our server memory. And although there's no evidence the private encryption key for Ars' previous TLS certificate was compromised, the replacement ensured no one could impersonate the site in the event hackers obtained the key.

With Ars servers fully updated, it's time to turn our attention to the next phase of recovery. In the hours immediately following the public disclosure of the so-called Heartbleed vulnerability, several readers reported their Ars accounts were hijacked by people who exploited the bug and obtained other readers' account passwords. There's no way of knowing if compromises happened earlier than that. Ars has no evidence such hacks did occur, but two years is a long time. There's simply no way of ruling out the possibility.

It's for this reason that Ars strongly recommends all readers change their account passwords. A password change is especially urgent for people who logged in between Monday evening and mid morning on Tuesday. It's also particularly important for anyone who used their Ars password to protect accounts on other sites or anyone whose Ars accounts contained private messages of a sensitive nature. But again, out of an abundance of caution, Ars strongly urges all users to reset their pass codes.

As always, security-conscious readers should choose unique, randomly generated passwords at least nine characters long that contain upper- and lower-case letters, numbers, and symbols. For a refresher on good password hygiene, see Ars senior IT reporter Jon Brodkin's The secret to online safety: Lies, random characters, and a password manager.