As an IT professional, I am very concerned at the news that Heartbleed can exploit weaknesses in the OpenSSL architecture. Is there any risk to users logging onto Salesforce via browser or app?
There was a salesforce known issue around this that states the following:
At salesforce.com, trust is our #1 value and we take the protection of our customers' data very seriously. On April 7, the OpenSSL Project released an update to address a vulnerability nicknamed “Heartbleed". Salesforce is not running the vulnerable version of OpenSSL and there is no impact to the Salesforce service.
I've not seen any other public facing statements.