Well, I saw 2 mailing lists : 1 announce ; not used since four years...
and 1 commit, that, as its name says, just posts about commits (on dev board, as far I can understand it
so the question is : is there a mailing list that is used to post about security fixes, releases about phpbb 2.* ?
and, as I think the answer is "no", why not ?