diff --git a/NEWS b/NEWS
index 0d736780c37..ecd0a8e3785 100644
--- a/NEWS
+++ b/NEWS
@@ -2,10 +2,15 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? ????, PHP 8.2.3
 
+- Core:
+  . Fixed bug #81744 (Password_verify() always return true with some hash).
+    (CVE-2023-0567) (Tim Düsterhus)
+  . Fixed bug #81746 (1-byte array overrun in common path resolve code).
+    (CVE-2023-0568) (Niels Dossche)
+
 - FPM:
   . Fixed bug GHSA-54hq-v5wp-fqgv (DOS vulnerability when parsing multipart
-    request body). (Jakub Zelenka)
-
+    request body). (CVE-2023-0662) (Jakub Zelenka)
 
 02 Feb 2023, PHP 8.2.2