Update CHANGES

* Add check for regex denial of service (Ben Toews)