Mailing list for future vulnerabilities??

Hello, I blanched when I just happened by your site and saw the vulnerability that version 4.2.2 addresses. As a user of PHP in a production web environment, (which will soon have credit card data on it) I was upset that I was not made aware of this vulnerability sooner. I immediately upgraded my system, but I was wondering if there is a mailing list exclusively for alerting people to security vulnerabilities or similar urgent issues. As we are a small shop, I do not have time to wade through the regular mailing PHP lists every day in the off chance there is a security bulletin. I am a strong proponent of open source software, but it is hard to make a business case for PHP if you can't expect to be alerted to vulnerabilities as they are discovered. If a security mailing list exists, please let me know. If not, I would strongly suggest that you take a cue from our friends at M$ and set something up! (And put links to it in your vulnerability announcements.) Thank you very much, -Bob