Security advisories are normally posted by the project maintainers. In the case of Heartbleed, that would be the OpenSSL team. You should subscribe to the Project Announcements mailing list at https://www.openssl.org/support/community.html.
This OpenSSL mailing list (linked to above) will only address security vulnerabilities (and project releases) specifically for OpenSSL. You should subscribe to other mailing lists for other projects for which you wish to receive notifications (such as Apache, CentOS, RedHat, Ubuntu, pfSense, or what-have-you).