Fix #1599 for 2.7(.10)
diff --git a/release-notes/VERSION b/release-notes/VERSION
index 573e710..62f7465 100644
--- a/release-notes/VERSION
+++ b/release-notes/VERSION
@@ -6,6 +6,8 @@
 
 2.7.10 (not yet released)
 
+#1599: Jackson Deserializer security vulnerability
+ (reported by ayound@github)
 - Minor robustification of method resolution in `AnnotatedClass`
 
 2.7.9 (04-Feb-2017)