@wp_smith @markjaquith per codex, e-mail security@wordpress.org w/ as much info as possible codex.wordpress.org/FAQ_Security