update NEWS

Author: weltling

NEWS

@@ -5,6 +5,8 @@ PHP                                                                        NEWS
 - Core:
   . Fixed bug #72907 (null pointer deref, segfault in gc_remove_zval_from_buffer
     (zend_gc.c:260)). (Laruence)
+  . Fixed bug #72703 (Out of bounds global memory read in BF_crypt triggered by
+    password_verify). (Anatol)
 
 - Dba:
   . Fixed bug #71514 (Bad dba_replace condition because of wrong API usage).