diff --git a/NEWS b/NEWS
index 57b4b57bd26..e43e600f59a 100644
--- a/NEWS
+++ b/NEWS
@@ -47,6 +47,7 @@ PHP                                                                        NEWS
   . Implement More Appropriate Date/Time Exceptions RFC. (Derick)
 
 - DOM:
+  . Fix bug GH-8388 (DOMAttr unescapes character reference). (Tim Starling)
   . Fix bug GH-11308 (getElementsByTagName() is O(N^2)). (nielsdos)
 
 - Exif:
diff --git a/UPGRADING b/UPGRADING
index 5c81ef8b325..643c8d68ab9 100644
--- a/UPGRADING
+++ b/UPGRADING
@@ -44,6 +44,10 @@ PHP 8.3 UPGRADE NOTES
   . Static variable initializers can now contain arbitrary expressions.
     RFC: https://wiki.php.net/rfc/arbitrary_static_variable_initializers
 
+- DOM:
+  . Assignment to DOMAttr::$value and DOMAttr::$nodeValue no longer expands
+    entities in the new value.
+
 - FFI:
   . C functions that have a return type of void now return null instead of
     returning the following object object(FFI\CData:void) { }