diff --git a/Misc/NEWS b/Misc/NEWS
index 03cd7df..f5275b8 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -610,6 +610,9 @@
 
 - Issue #2389: Array objects are now pickled in a portable manner.
 
+- Expat: Fix DoS via XML document with malformed UTF-8 sequences
+  (CVE_2009_3560).
+
 Build
 -----