I have two sites still not updated (I though I have enabled auto update, but somehow it didn't work), and fortunately they were not hacked before I manually updated them today.

Considering there are so many sites running WP, the impact is going to be huge. Is there a place that site owners can sign up for security notification?