Updated security notice to point to core.security.php