update news with CVE
MErge branch 'PHP-5.4' into PHP-5.5

* PHP-5.4:
  update news with CVE