diff --git a/NEWS b/NEWS
index 97ace3a..0a6f071 100644
--- a/NEWS
+++ b/NEWS
@@ -1,6 +1,79 @@
 This is ShadowIRCd 6.3, Copyright (c) 2005-2011 ShadowIRCd team.
 See LICENSE for licensing details (GPL v2).
 
+-- shadowircd 6.4.0
+* This is primarily made up of backports from Charybdis 3.4.0
+
+server protocol
+- Add channel ban forwarding <mask>$<channel> much like ircd-seven. Local use
+  of this is controlled by the channel::use_forward config option.
+- Allow RSFNC (forced nick change from services) to change a nickname's
+  capitalization only.
+- Add ENCAP TGINFO to propagate IP addresses that exceeded target change
+  limits (these get a lower limit when they reconnect). The message's source
+  is the user that exceeded the limit and one parameter "0" is required.
+user
+- Allow mode queries on mlocked modes. In particular, allow /mode #channel f
+  to query the forward channel even if +f is mlocked.
+- Consider bogus CTCP ACTION messages (without action text) CTCP (for
+  cmode +C).
+- Apply colour stripping (cmode +c) and CTCP checking (cmode +C) to messages
+  to @/+ channel as well.
+- Channel mode +c (and other places that disallow colour codes) now also strip
+  ASCII 4 (a different kind of colour code).
+- Add an error message (numeric 743) if a ban mask is invalid.
+- Extract the underlying IPv4 address from 6to4 and Teredo IPv6 addresses.
+  Show it in a remote /whois and check channel bans, quiets, D:lines and
+  K:lines against it. Note that ban exceptions and auth{} blocks are not
+  checked.
+- Send ERR_TOOMANYCHANNELS for each channel join that fails due to channel
+  limits, instead of one per JOIN command.
+- Add account-notify client capability to notify clients about logins and
+  logouts of users in common channels. See doc/account-notify.txt.
+- Add away-notify client capability. See doc/away-notify.txt.
+- Add extended-join client capability to add account name and ircname to JOIN.
+  See doc/extended-join.txt.
+- Disallow wildcarded nicknames in "hunted" parameters like /stats and /motd.
+- Disallow mIRC italics in channel names when disable_fake_channels.
+- Add AUTHENTICATE EXTERNAL support, allows SASL authentication using an SSL
+  certificate fingerprint.
+- Allow channel::kick_on_split_riding to protect channels with mlocked keys.
+  This works with atheme-services 5.2.0 or newer.
+- The NICKLEN token in 005 now only specifies the maximum nick length for
+  this server/user. The MAXNICKLEN token specifies the maximum nick length
+  any user can have.
+- Disallow '$' in usernames as this may cause problems with ban forwarding.
+- Allow normal users to perform /privs on themselves, showing some privileges
+  from the auth{} block.
+- Rate limit high-bandwidth commands, in particular /who <channel>.
+- Rate limit /away to help avoid flooding via away-notify.
+oper
+- Add operspy for /list.
+- Add /stats C to show information about dynamically loaded server
+  capabilities.
+- Add a server notice to snomask +b if a user exceeds target change limits.
+- Add missing server notice for kills from RSFNC and SVSLOGIN.
+config
+- Add support for IPv6 DNSBLs. A new "type" option specifies the IP version(s)
+  for which each DNSBL should be checked.
+- Make flood control settings configurable by those who know exactly what they
+  are doing.
+- Add serverinfo::nicklen config option to limit the nick length for local
+  users. Different values of this option do not break the server protocol.
+- Add general::away_interval to allow configuring /away rate limiting.
+- Add listener::defer_accept to delay accepting a connection until the client
+  sends data. This depends on kernel support. It may break BOPM checking.
+- Add general::resv_fnc to forcibly change nicks of local users that match a
+  newly set nick RESV, default enabled.
+- Add extb_usermode extension, $m:+-<modes> extban matching against umodes.
+- Extend extb_oper extension to allow matching against oper privileges.
+misc
+- Work around timerfd/signalfd brokenness on OpenVZ.
+- Add --with-custom-branding and --with-custom-version configure options to
+  help forks/patchsets distinguish themselves.
+- Ensure SIGHUP and SIGINT keep working after a SIGINT restart.
+- Remove broken GnuTLS support. SSL/TLS is now only provided using OpenSSL.
+
 -- shadowircd 6.3.2.1
 
 bugfixes