diff --git a/NEWS b/NEWS
index f2c7302f7..ed7f7c510 100644
--- a/NEWS
+++ b/NEWS
@@ -1,3 +1,12 @@
+Changes in 1.18.4
+=================
+Released: 2024-04-18
+
+- Don't allow commandline arrays when the first commandline item starts with
+  whitespace or hyphen. (CVE-2024-32462)
+- Do not store device access permission if it returned an error.
+- Fix crash with config files without a default backend set.
+
 Changes in 1.18.3
 =================
 Released: 2024-04-04