A report suggested that the NSA already knew about the Heartbleed bug 2 years ago and took advantage (http://www.bloomberg.com/news/2014-04-11/nsa-said-to-have-

A report suggested that the NSA already knew about the Heartbleed bug 2 years ago and took advantage (http://www.bloomberg.com/news/2014-04-11/nsa-said-to-have-used-heartbleed-bug-exposing-consumers.html http://www.bloomberg.com/news/2014-04-11/nsa-said-to-have-us...) This suggests that first the NSA discovered it, then Neel Mehta, and finally Codenomicon. As other commenters have rightly suggested, the government, or at least an agency there of, uses information asymmetry as a weapon of intelligence on its users (aka citizens). In the case of private corporations, they have a more contractual duty to their users to ensure that these bugs are patched so that those with malevolent intentions can't harm their users. In my opinion, a bug that has been discovered but not shared is just as bad as a weaponized biological agent. Each rely on secrecy to exploit a group that is unaware.