Today I found out that the security updates issued via the App Store (or Software Update, for older versions) do not include a updated version of bash which patches the Shellshock vulnerability.
To secure your system, for this one patch you need to download it manually from Apple. Weird, but better than nothing.
Sadly, as declared earlier 10.6 (Snow Leopard) has been left out. It's probably not impossible to patch since the bash version that 10.6.8 shipped with is available here. Not as great as the seemingly neverending support that Windows XP seems to get, but at least there is a option.
If I have time one of these days I might take a look at it.