In a shift toward transparency, the National Security Agency announced a bug that could have left over 900 million PCs vulnerable to attack.