Hacker News Reader

The developers themselves have clarified. Software that is not actively maintained should be assumed to be insecure.

link/source?

The Security Now show from the week after the event had a pretty thorough recounting of what happened. I'd recommend starting there.

Security Now! episode #458 - 10 Jun 2014

Skip to 2 minutes in if you don't want to hear the drawn out intro