Input parser bugs appear to be simple. For years, they've been among the best-understood bug kinds. Yet 2014 could be called The Year of Parser Bugs on account of Heartbleed alone, and there are more such bugs in the 2014 Pwnie Award nominations. In 2013, parser bugs were over a half of all nominated server-side bugs. When simple bugs account for most impactful vulnerabilities, perhaps they are not so simple after all.