Update UPGRADING

diff --git a/UPGRADING b/UPGRADING
index 3dfaad6d907652f2373099d76104363907e2564f..40a768d6ba6f37b1242fb03149ff6cb127739888 100644 (file)
--- a/UPGRADING
+++ b/UPGRADING
@@ -125,6 +125,11 @@ DOM:
         After: ReflectionMethod::getClosure($object = null)
     The new signature is also (LSP) compatible with older PHP versions.
 
+- SAPI:
+  . Starting with 7.4.12, incoming cookie names are not url-decoded. This was never 
+    required by the standard, outgoing cookie names aren't encoded and this leads 
+    to security issues (CVE-2020-7070).
+
 - SPL:
   . Calling get_object_vars() on an ArrayObject instance will now always return
     the properties of the ArrayObject itself (or a subclass). Previously it