diff --git a/CHANGES.md b/CHANGES.md
index 230103d1..8191b01d 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -7,7 +7,8 @@ Notable changes between versions.
 ## v1.9.4
 
 * Kubernetes [v1.9.4](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.9.md#v194)
-  * Upstream changed secret, configMap, downward API, and projected volumes to be read-only (breaking, [kubernetes#58720](https://github.com/kubernetes/kubernetes/pull/58720))
+  * Secret, configMap, downward API, and projected volumes now read-only (breaking, [kubernetes#58720](https://github.com/kubernetes/kubernetes/pull/58720))
+  * Mitigated `subPath` [CVE-2017-1002101](https://github.com/kubernetes/kubernetes/issues/60813)
 * Introduce [worker pools](https://typhoon.psdn.io/advanced/worker-pools/) for AWS and Google Cloud for joining heterogeneous workers to existing clusters.
 * Use new Network Load Balancers and cross zone load balancing on AWS
 * Allow flexvolume plugins to be used on any Typhoon cluster (not just bare-metal)