Newly discovered flaw undermines HTTPS connections for almost 1,000 sites