It turns out the engineer behind the Heartbleed bug introduced it on New Year’s Eve 2011, and he says he “missed the necessary validation oversight.”