This is pretty much a solved problem. It is coordinated through the
vendor security contacts lists that Ian was talking about. It happens
more often than you may realise: Apache or OpenSSL or the Linux kernel
or some other pervasive, critical component has a security hole
discovered and the release of the updates is coordinated and
simultaneous. So Apple would release the updates on the same day as
everybody else. If you do it well, you don't end up where people look at
you like Microsoft and think they can't trust the update (another
advantage of Open Source, too). Often the upstream source can supply the
patch, so the vendors need only audit it and do package rebuilds and
rush it through release QA (again, they'll often have priority paths
internally for security fixes).

Regards,
Malcolm