diff --git a/docs/release-notes.asciidoc b/docs/release-notes.asciidoc
index 8593ae8f67..ec74c34372 100644
--- a/docs/release-notes.asciidoc
+++ b/docs/release-notes.asciidoc
@@ -9,6 +9,7 @@ This section summarizes the changes in each release.
 * <<release-notes-8.19.2, {elastic-sec} version 8.19.2>>
 * <<release-notes-8.19.1, {elastic-sec} version 8.19.1>>
 * <<release-notes-8.19.0, {elastic-sec} version 8.19.0>>
+* <<release-notes-8.18.8, {elastic-sec} version 8.18.8>>
 * <<release-notes-8.18.7, {elastic-sec} version 8.18.7>>
 * <<release-notes-8.18.6, {elastic-sec} version 8.18.6>>
 * <<release-notes-8.18.5, {elastic-sec} version 8.18.5>>
diff --git a/docs/release-notes/8.18.asciidoc b/docs/release-notes/8.18.asciidoc
index 2fbb0b7410..2e84dfbc7f 100644
--- a/docs/release-notes/8.18.asciidoc
+++ b/docs/release-notes/8.18.asciidoc
@@ -1,6 +1,33 @@
 [[release-notes-header-8.18.0]]
 == 8.18
 
+[discrete]
+[[release-notes-8.18.8]]
+=== 8.18.8
+
+[discrete]
+[[features-8.18.8]]
+==== New features
+* Adds an {elastic-defend} option to remediate orphaned state by attempting to start Elastic Agent service.
+
+[discrete]
+[[enhancements-8.18.8]]
+==== Enhancements
+* Increases the throughput of {elastic-defend} Logstash connections by increasing the maximum size it can upload at once.
+
+[discrete]
+[[bug-fixes-8.18.8]]
+==== Fixes
+* Removes `null` in confirmation dialog when bulk editing index patterns for rules ({kibana-pull}236572[#236572]).
+* Fixes the URL passed to detection rule actions via the `{{context.results_link}}` placeholder ({kibana-pull}236067[#236067]).
+* Adds support in {elastic-defend} for installing eBPF probes on Linux endpoints when taskstats is compiled out of the kernel.
+* Fixes a bug in {elastic-defend} where Linux network events could have source and destination bytes swapped.
+* Removes `.process.thread.capabilities.permitted` and `.process.thread.capabilities.effective` from Linux network events in {elastic-defend}.
+* Fixes a bug in {elastic-defend} where host isolation could auto-release incorrectly. Host isolation now only releases when {elastic-endpoint} becomes orphaned. Intermittent {elastic-agent} connectivity changes no longer alter the host isolation state.
+* Improves the reliability of local {elastic-defend} administrative shell commands. In rare cases, a command could fail to execute due to issue with interprocess communication.
+* Fixes an issue where {elastic-defend} would incorrectly calculate throughput capacity when sending documents to output.  This may have limited event throughput on extremely busy endpoints.
+* Fixes an issue in {elastic-defend} installation logging where only the first character of install paths (usually 'C') would be logged.
+
 [discrete]
 [[release-notes-8.18.7]]
 === 8.18.7