Heartbleed bug still affects thousands of sites

US still has more than 42,000 websites vulnerable to the flaw, which can allow an attacker to steal data directly from websites and users.