diff --git a/NEWS b/NEWS
index 0b9871f966..29bbedeac3 100644
--- a/NEWS
+++ b/NEWS
@@ -153,6 +153,10 @@ New Functionality
   Note that generally you should prefer record extension in conditionally loaded
   scripts rather than using conditional directives in the original record definition.
 
+- The 'X' code can now appear in a connection's history. It is meant to indicate
+  situations where Zeek stopped analyzing traffic due to exceeding certain limits or
+  when encountering unknown/unsupported protocols. Its first use is to indicate
+  ``Tunnel::max_depth`` being exceeded.
 
 Changed Functionality
 ---------------------
@@ -172,6 +176,10 @@ Changed Functionality
   detail API from ``digest.h`` to compute hashes likely need to accommodate for
   this change.
 
+- The ``Tunnel::max_depth`` default was changed from 2 to 4 allowing for more than
+  two encapsulation layers. Two layers are already easily reached in AWS GLB
+  environments.
+
 Removed Functionality
 ---------------------