Update NEWS

Author: cmb69

NEWS

@@ -40,10 +40,13 @@ PHP                                                                        NEWS
 	(Kalle)
 
 - FPM:
+  . Fixed bug #78599 (env_path_info underflow in fpm_main.c can lead to RCE).
+    (CVE-2019-11043) (Jakub Zelenka)
   . Fixed bug #78413 (request_terminate_timeout does not take effect after
     fastcgi_finish_request). (Sergei Turchanov)
 
 - MBString:
+  . Fixed bug #78633 (Heap buffer overflow (read) in mb_eregi). (cmb)
   . Fixed bug #78579 (mb_decode_numericentity: args number inconsistency).
     (cmb)
   . Fixed bug #78609 (mb_check_encoding() no longer supports stringable