diff --git a/release-notes/CREDITS b/release-notes/CREDITS
index 93b1721fea..09621ce584 100644
--- a/release-notes/CREDITS
+++ b/release-notes/CREDITS
@@ -596,6 +596,11 @@ Joshua Jones
    with a non-default constructor and a mutator annotated with `@JsonUnwrapped`
    (2.8.8)
 
+Ivo Studens (istudens@redhat.com)
+  * Contributed #1585: Invoke ServiceLoader.load() inside of a privileged block
+    when loading modules using `ObjectMapper.findModules()`
+  (2.8.9)
+
 Connor Kuhn (ckuhn@github)
   * Contributed #1341: FAIL_ON_MISSING_EXTERNAL_TYPE_ID_PROPERTY
    (2.9.0)
diff --git a/release-notes/VERSION b/release-notes/VERSION
index 4ea22038d5..925d01232f 100644
--- a/release-notes/VERSION
+++ b/release-notes/VERSION
@@ -3,6 +3,12 @@ Project: jackson-databind
 === Releases ===
 ------------------------------------------------------------------------
 
+2.8.9 (not yet released)
+
+#1585: Invoke ServiceLoader.load() inside of a privileged block when loading
+  modules using `ObjectMapper.findModules()`
+ (contributed by Ivo S)
+
 2.8.8 (05-Apr-2017)
 
 (partial) #994: `DeserializationFeature.UNWRAP_SINGLE_VALUE_ARRAYS` only works for POJOs, Maps