1 files changed, 10 insertions, 0 deletions
diff --git a/NEWS b/NEWS
index 40e69e88ed..9c22f96c1d 100644
--- a/NEWS
+++ b/NEWS
@@ -29,6 +29,16 @@ PHP                                                                        NEWS
   . Fixed bug #79257 (Duplicate named groups (?J) prefer last alternative even
     if not matched). (Nikita)
 
+- Phar:
+  . Fixed bug #79082 (Files added to tar with Phar::buildFromIterator have
+    all-access permissions). (CVE-2020-7063) (stas)
+  . Fixed bug #79171 (heap-buffer-overflow in phar_extract_file).
+    (CVE-	2020-7061) (cmb)
+
+- Session:
+  . Fixed bug #79221 (Null Pointer Dereference in PHP Session Upload Progress).
+    (CVE-2020-7062) (stas)
+
 - Standard:
   . Fixed bug #79254 (getenv() w/o arguments not showing changes). (cmb)