diff --git a/NEWS b/NEWS
index c8ded9b6051..04c3c29f55f 100644
--- a/NEWS
+++ b/NEWS
@@ -6,6 +6,14 @@ PHP                                                                        NEWS
   . Added pdeathsig to builtin server to terminate workers when the master
     process is killed. (ilutov)
 
+- GD:
+  . Fixed bug #81739: OOB read due to insufficient input validation in
+    imageloadfont(). (CVE-2022-31630) (cmb)
+
+- Hash:
+  . Fixed bug #81738: buffer overflow in hash_update() on long parameter. 
+    (CVE-2022-37454) (nicky at mouha dot be)
+
 - Core:
   . Fixed bug GH-9388 (Improve unset property and __get type incompatibility
     error message). (ilutov)