diff --git a/CHANGELOG.md b/CHANGELOG.md
index 86aead527..38e2a6a81 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,12 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 
 ## [Unreleased]
 
+## [8.4.2] - released 2023-07-xx
+### Security
+- If a key string is provided to the CryptKey constructor with an invalid
+  passphrase, the LogicException message generated will contain the given key.
+  The key is no longer leaked via this exception (PR #1353)
+
 ## [8.4.1] - released 2023-03-22
 ### Fixed
 - Fix deprecation notices for PHP 8.x (PR #1329)