This is why the assumption that “open source code is more likely to be closely audited for vulnerabilities” is not true (even for incredibly core/important projects with a wide scope) and is potentially dangerous to rely on.

Shellshock still outperforms any security issue of OpenSSL in terms of time in the wild.