diff --git a/NEWS b/NEWS
index 6d334708..31c9aeaa 100644
--- a/NEWS
+++ b/NEWS
@@ -2,6 +2,20 @@ Changes in 1.10.8
 ~~~~~~~~~~~~~~~~~
 Not released yet
 
+Security fixes:
+
+ * Escape special characters when displaying permissions and metadata,
+   preventing malicious apps from manipulating the appearance of the
+   permissions list using crafted metadata (CVE-2023-28101).
+
+ * If a Flatpak app is run on a Linux virtual console (tty1, tty2, etc.),
+   don't allow copy/paste via the TIOCLINUX ioctl (CVE-2023-28100).
+   Note that this is specific to virtual consoles: Flatpak is not
+   vulnerable to this if run from a graphical terminal emulator such as
+   xterm, gnome-terminal or Konsole.
+
+Other bug fixes:
+
  * If an app update is blocked by parental controls policies, clean up the
    temporary deploy directory (#5146)
  * Fix Autotools build with versions of gpgme that no longer provide
@@ -16,6 +30,7 @@ Not released yet
  * Fix a typo in an error message
  * Fix incorrect year in NEWS for 1.10.7 release
  * Translation update: pl
+ * Add test coverage for Flatpak's seccomp filters
 
 Changes in 1.10.7
 ~~~~~~~~~~~~~~~~~