put a big red link to BEF server in changelog

and fixed a nuke exploit