WPA: AirPort Cards, Yes; AirPort Base Stations, No
I have been asked more frequently than practically any other question on AirPort: Can I upgrade an old AirPort network to use WPA (Wi-Fi Protected Access) security? The answer: sort of. AirPort Cards installed on computer that are running Mac OS X 10.3.0 or later can use firmware and operating system upgrades that allow an AirPort Card to handle WPA correctly on Apple and non-Apple networks. Earlier versions of Mac OS X and any version of Mac OS 8 or 9 cannot handle WPA because the operating system isn't designed for it; no third party wireless card offers WPA support before 10.3, either.
The bad news: graphite and snow AirPort Base Stations cannot, under any circumstances, be firmware upgraded to handle WPA. The hardware and software combination just won't work. You'll need a new base station, either from Apple or from another firm, to handle it. Mass-market base stations like the Linksys WRT54G can be had for $50 or less. (I write extensively in Take Control of Your AirPort Network about whether a non-Apple base station can work for your network.)
WPA2, by the way, is yet a different answer. WPA uses the TKIP (Temporal Key Integrity Protocol) encryption system, while WPA2 can use either TKIP or AES-CCMP (a long acronym). TKIP works with older gear; AES-CCMP requires newer hardware--devices shipped since late 2002. Under Mac OS X 10.3.3 to 10.3.9 or Mac OS X 10.4.2 or later, you can upgrade AirPort Extreme Cards, AirPort Extreme Base Stations, and AirPort Express Base Stations to handle WPA2.