Firefox 3.6.16 and 3.5.18 security updates released as Firefox 4 launches
In fact, both Firefox 3.6 and 3.5 received security updates in tandem with the Firefox 4 release. The new versions blacklist a handful of invalid HTTPS certificates which were issued by Comodo.
Firefox's internal update mechanism should take care of the process for you, but you can always give it a push by clicking Help > Check for Updates. Mozilla does urge users to upgrade to Firefox 4, and there's really no reason not to. If you're ready to make the move, just visit getfirefox.com and you'll be offered the correct version for your operating system.