Merge branch '2.8' into 2.9
diff --git a/release-notes/VERSION-2.x b/release-notes/VERSION-2.x
index d878840..6f1d5ba 100644
--- a/release-notes/VERSION-2.x
+++ b/release-notes/VERSION-2.x
@@ -4,6 +4,11 @@
 === Releases === 
 ------------------------------------------------------------------------
 
+2.9.10.3 (not released yet)
+
+#2620: Block one more gadget type (xbean-reflect/JNDI - CVE-2020-8840)
+ (reported by threedr3am@github)
+
 2.9.10.2 (03-Jan-2020)
 
 #2526: Block two more gadget types (ehcache/JNDI - CVE-2019-20330)