Vulnerabilities can be reported by creating a new issue.

If you consider the vulnerability to be sensitive or want to report something discreetly, send an e-mail to mrook AT php DOT net.