news about release 1.2.6

Signed-off-by: Ceki Gulcu <ceki@qos.ch>

logback-site/src/site/pages/news.html

@@ -30,6 +30,17 @@ <h2>Logback News</h2>
     the <a href="http://www.qos.ch/mailman/listinfo/announce">QOS.ch
     announce</a> mailing list.</p>
 
+    <hr width="80%" align="center" />
+
+    <h3>10th of September, 2021, Release of version 1.2.6</h3>
+
+    <p>&bull; To prevent XML eXternal Entity injection (XXE) attacks, Joran
+    no longer reads external entities passed in XML files. This fixes
+    <a href="https://jira.qos.ch/browse/LOGBACK-1465">LOGBACK-1465</a>
+    as reported by Shuibo Ye.
+    </p>
+
+
     <hr width="80%" align="center" />
 
     <h3>23rd of August, 2021, Release of version 1.3.0-alpha10</h3>