[ci skip] Update NEWS

diff --git a/NEWS b/NEWS
index 4c32080d3b4e6fbecb09b921dada60d670f563d1..db9d5fa8cf023407f6a09d182dea8f74501efd11 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -2,6 +2,10 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? ????, PHP 7.3.14
 
+- Core:
+  . Fixed bug #78943 (mail() may release string with refcount==1 twice).
+    (CVE-2019-11049). (cmb)
+
 - CURL:
   . Implemented FR #77711 (CURLFile should support UNICODE filenames). (cmb)