Update UPGRADING

Author: smalyshev

UPGRADING

@@ -125,6 +125,11 @@ DOM:
         After: ReflectionMethod::getClosure($object = null)
     The new signature is also (LSP) compatible with older PHP versions.
 
+- SAPI:
+  . Starting with 7.4.12, incoming cookie names are not url-decoded. This was never 
+    required by the standard, outgoing cookie names aren't encoded and this leads 
+    to security issues (CVE-2020-7070).
+
 - SPL:
   . Calling get_object_vars() on an ArrayObject instance will now always return
     the properties of the ArrayObject itself (or a subclass). Previously it