--- a/ChangeLog	Fri Mar 29 03:34:41 2019 +0000
+++ b/ChangeLog	Fri May 10 18:12:17 2019 +0100
@@ -1,3 +1,7 @@
+2019-05-10  Andrew John Hughes  <gnu_andrew@member.fsf.org>
+
+	* NEWS: Add 2.6.18 release notes.
+
 2019-03-28  Andrew John Hughes  <gnu_andrew@member.fsf.org>
 
 	* NEWS: Add 2.6.17 release notes.

--- a/NEWS	Fri Mar 29 03:34:41 2019 +0000
+++ b/NEWS	Fri May 10 18:12:17 2019 +0100
@@ -25,6 +25,40 @@
   - PR3162: Remove reference to AbstractPlainDatagramSocketImpl.c, removed in 8072466
   - PR3494: Skip AES test on AArch64 due to VM crash
 
+New in release 2.6.18 (2019-05-01):
+
+* Security fixes
+  - S8211936, CVE-2019-2602: Better String parsing
+  - S8218453, CVE-2019-2684: More dynamic RMI interactions
+  - S8219066, CVE-2019-2698: Fuzzing TrueType fonts: setCurrGlyphID()
+* Import of OpenJDK 7 u211 build 1
+  - S8003846: Override mechanism for currency data should not require creating currency.properties in java.home
+  - S8129361: ISO 4217 amendment 160
+  - S8129822: Define "headful" jtreg keyword
+  - S8145952: ISO 4217 amendment 161
+  - S8164784: ISO 4217 amendment 162
+  - S8202088: Japanese new era implementation
+  - S8204142: AWT hang occurs when sequenced events arrive out of sequence in multiple AppContexts
+  - S8205432: Replace the placeholder Japanese era name
+  - S8206120: Add test cases for lenient Japanese era parsing
+  - S8207152: Placeholder for Japanese new era should be two characters
+  - S8207258: Distrust TLS server certificates anchored by Symantec Root CAs
+  - S8208656: Move java/util/Calendar/CalendarTestScripts tests into OpenJDK
+  - S8216280: Allow later Symantec Policy distrust date for two Apple SubCAs
+  - S8217579: TLS_EMPTY_RENEGOTIATION_INFO_SCSV is disabled after 8211883
+  - S8219890: [TEST_BUG] Calendar.getDisplayName() returns empty string for new Japanese Era on some locales
+  - S8222449: freetypecheck compares versions using lexicographic comparison
+* Bug fixes
+  - PR3730: Change policytool.desktop.in category Development to Settings
+  - PR3731: Use JRE bin directory in policytool.desktop.in
+  - PR3732: Use SDK bin directory in jconsole.desktop.in
+  - PR3733: Use shortened Java version first in Name field of desktop files
+  - PR3737: Use https URLs where possible.
+  - PR3739: PR2886 breaks make clean
+* AArch64 port
+  - S8219635, PR3726: aarch64: missing LoadStore barrier in TemplateTable::fast_storefield
+  - S8221220, PR3726: AArch64: Add StoreStore membar explicitly for Volatile Writes in TemplateTable
+
 New in release 2.6.17 (2019-03-16):
 
 * Security fixes