diff --git a/CHANGELOG b/CHANGELOG
index 8515e585..14c5d87f 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,4 +1,4 @@
-## 2.6.1
+## 2.6.1 - 2.6.4
 
 Attention all users: For pre 2.6 applications to work with web2py >=2.6, you must copy static/js/web2py.js, controllers/appadmin.py, and views/appadmin.html from the welcome app to your own apps (all of them).
 
@@ -38,6 +38,8 @@ Attention MySQL users: The length of string fields changed from 255 to 512 bytes
 - speedup for define_table, thanks Michele
 - settings.cfg to admin, thanks Paolo
 - many bugs fixed, thanks Niphlod, Michele, Roberto, Jonathan, and many others
+- 2.6,3 specifically fixed a possible DoS vulnerability
+- 2.6.4 specifically fixes major problem introduced in 2.6.1 with session logic
 
 ## 2.5.2
 
diff --git a/Makefile b/Makefile
index 26ac8c88..20aa006a 100644
--- a/Makefile
+++ b/Makefile
@@ -30,7 +30,7 @@ update:
 	echo "remember that pymysql was tweaked"
 src:
 	### Use semantic versioning
-	echo 'Version 2.6.3-stable+timestamp.'`date +%Y.%m.%d.%H.%M.%S` > VERSION
+	echo 'Version 2.6.4-stable+timestamp.'`date +%Y.%m.%d.%H.%M.%S` > VERSION
 	### rm -f all junk files
 	make clean
 	### clean up baisc apps
diff --git a/VERSION b/VERSION
index dd150210..862fcdb5 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-Version 2.6.3-stable+timestamp.2013.09.21.18.14.28
+Version 2.6.4-stable+timestamp.2013.09.21.20.23.38