diff --git a/Misc/NEWS b/Misc/NEWS
index 7eb828f..12df9ec 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -667,6 +667,9 @@
   unix environment even if DISPLAY was not set. Also, support for
   skipstone browser was included.
 
+- Fixed bug #636769: rexec would run unallowed code if subclasses of
+  strings were used as parameters for certain functions.
+
 Tools/Demos
 -----------