This past year saw the revelation of three massive security bugs – Heartbleed, POODLE and Shellshock – that existed for lengthy periods of time before they were discovered. Three of the bugs were identified in April, but had existed in the wild since December 2011. For instance, the Heartbleing vulnerability exposed in April was identified in March, but it was discovered in December 2011, when it was only discovered in April 2011, and existed for more than a year before being discovered.”]
Source: https://www.govinfosecurity.com/2014-year-new-old-bugs-a-7681