Both Sprint and T-Mobile announced OTA updates for two long-forgotten handsets today stuck on Android 4.1.1 - the Samsung Nexus S and the HTC One S, respectively (that is, the Sprint Nexus S and the T-Mobile One S).
Both updates are described merely as containing security enhancements, but given that Android 4.1.1 is the only known OS version potentially vulnerable to the now-infamous heartbleed exploit, it's fairly easy to determine what this is all about (HTC's site actually confirms as much). It's certainly big of T-Mobile, Sprint, HTC, and Samsung to make this happen at all - many phones languish with serious security flaws after their software support comes to an end, but it seems Heartbleed got enough press that the parties involved deemed the fix a worthwhile endeavor.
If you have either of these devices (at this point, why would you?), check for the update, it should be available now.