chore: update release notes to reflect security disclosures

Author: chadlwilson

source/partials/release_notes/_release-26-1-0.md.erb

@@ -38,6 +38,13 @@ average report quality of reports - hence there are 10 distinct vulnerabilities
 To give users some time to mitigate or upgrade, these vulnerabilities will be disclosed 2-4 weeks from now via
 GitHub Security Advisories and formal CVEs according to our <%= link_to 'disclosure policy', 'https://github.com/gocd/gocd/security/policy#disclosure-policy' %>.
 
+<b>26 July 2026 update</b>: security issues fixed in 26.1.0 have been disclosed at https://github.com/gocd/gocd/security/advisories
+- One advisory is awaiting CVE assignment.
+- If the disclosed issues are not severe (or are easily mitigated) in your deployment context, and upgrading is time consuming for you, you may wish to wait for 26.2.0.
+- [GoCD 26.2.0](https://github.com/gocd/gocd/issues?q=milestone%3A%22Release%2026.2.0%22) will follow shortly in August 2026 and will contain fixes to additional security 
+vulnerabilities responsibly disclosed subsequent to the release of 26.1.0 and address reported regressions from 26.1.0 security improvements.
+- 26.2.0 is highly likely to have the same compatibility guarantees as 26.1.0 and be a straightforward upgrade.
+
 <h4>Java 21 is now the minimum supported version</h4>
 
 Java 21 was released in September 2023, and has had complete support within GoCD since version 24.1.0, over 2.5 years