diff -r 87440b63349b Misc/NEWS
--- a/Misc/NEWS	Mon Jun 27 12:30:48 2016 -0700
+++ b/Misc/NEWS	Mon Jun 27 23:13:06 2016 +0200
@@ -41,14 +41,14 @@ Library
   when exiting, let the new chained one through.  This avoids the PEP 479
   bug described in issue25782.
 
-- Issue #27278: Fix os.urandom() implementation using getrandom() on Linux.
+- [Security] Issue #27278: Fix os.urandom() implementation using getrandom() on Linux.
   Truncate size to INT_MAX and loop until we collected enough random bytes,
   instead of casting a directly Py_ssize_t to int.
 
 - Issue #26386: Fixed ttk.TreeView selection operations with item id's
   containing spaces.
 
-- Issue #22636: Avoid shell injection problems with
+- [Security] Issue #22636: Avoid shell injection problems with
   ctypes.util.find_library().
 
 - Issue #16182: Fix various functions in the "readline" module to use the
@@ -231,9 +231,9 @@ Core and Builtins
 Library
 -------
 
-- Issue #26556: Update expat to 2.1.1, fixes CVE-2015-1283.
-
-- Fix TLS stripping vulnerability in smptlib, CVE-2016-0772.  Reported by Team
+- [Security] Issue #26556: Update expat to 2.1.1, fixes CVE-2015-1283.
+
+- [Security] Fix TLS stripping vulnerability in smptlib, CVE-2016-0772.  Reported by Team
   Oststrom
 
 - Issue #21386: Implement missing IPv4Address.is_global property.  It was
@@ -258,7 +258,7 @@ Library
 - Issue #21313: Fix the "platform" module to tolerate when sys.version
   contains truncated build information.
 
-- Issue #26839: On Linux, :func:`os.urandom` now calls ``getrandom()`` with
+- [Security] Issue #26839: On Linux, :func:`os.urandom` now calls ``getrandom()`` with
   ``GRND_NONBLOCK`` to fall back on reading ``/dev/urandom`` if the urandom
   entropy pool is not initialized yet. Patch written by Colm Buckley.
 
@@ -366,7 +366,7 @@ Library
 - Issue #24838: tarfile's ustar and gnu formats now correctly calculate name
   and link field limits for multibyte character encodings like utf-8.
 
-- Issue #26657: Fix directory traversal vulnerability with http.server on
+- [Security] Issue #26657: Fix directory traversal vulnerability with http.server on
   Windows.  This fixes a regression that was introduced in 3.3.4rc1 and
   3.4.0rc1.  Based on patch by Philipp Hagemeister.
 
@@ -415,7 +415,7 @@ Library
 - Issue #26560: Avoid potential ValueError in BaseHandler.start_response.
   Initial patch by Peter Inglesby.
 
-- Issue #26313: ssl.py _load_windows_store_certs fails if windows cert store
+- [Security] Issue #26313: ssl.py _load_windows_store_certs fails if windows cert store
   is empty. Patch by Baji.
 
 - Issue #26569: Fix :func:`pyclbr.readmodule` and :func:`pyclbr.readmodule_ex`
@@ -477,7 +477,7 @@ Library
   the connected socket) when verify_request() returns false.  Patch by Aviv
   Palivoda.
 
-- Issue #25939: On Windows open the cert store readonly in ssl.enum_certificates.
+- [Security] Issue #25939: On Windows open the cert store readonly in ssl.enum_certificates.
 
 - Issue #25995: os.walk() no longer uses FDs proportional to the tree depth.