Currently being supported with security updates:

Please send them to me by email, as well as any diffs/patches you have, to be included on subsequent releases.

Information about the vulnerability is not to be released to a general audience; at least not until it was properly patched and a new release was publicly published, in which case it will be announced on (at least) the ChangeLog.