Now that a remote exploit in OpenSSH was discovered, the OpenBSD project has had to update the tag line on the project home page:

One remote hole in the default install, in nearly 6 years!

Still pretty impressive.