Owasp - I’m a member of the London Chapter, these guys are the best when it comes to securing Web Application
QAForums - You have to be prepared to browse though loads of dross to find a good thread or someone who actually knows a thing or two about testing. One or two good testers do hang out there though
WebAppSec Mailing List - List used by the pros in the Web Applicaiton Security business.