diff --git a/ChangeLog b/ChangeLog
index 6234248c8ec..0ee4ba066f6 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,6 +1,23 @@
 OpenVPN ChangeLog
 Copyright (C) 2002-2023 OpenVPN Inc <sales@openvpn.net>
 
+2023.11.17 -- Version 2.6.8
+
+Aquila Macedo (1):
+      doc: Correct typos in multiple documentation files
+
+Arne Schwabe (1):
+      Do not check key_state buffers that are in S_UNDEF state
+
+Frank Lichtenheld (1):
+      platform.c: Do not depend Windows build on HAVE_CHDIR
+
+Lev Stipakov (3):
+      config.h: fix incorrect defines for _wopen()
+      Make --dns options apply for tap-windows6 driver
+      Warn if pushed options require DHCP
+
+
 2023.11.08 -- Version 2.6.7
 
 Antonio Quartulli (1):
diff --git a/Changes.rst b/Changes.rst
index 3d4e0bde401..fc9edb99498 100644
--- a/Changes.rst
+++ b/Changes.rst
@@ -1,3 +1,30 @@
+Overview of changes in 2.6.8
+============================
+
+Bug fixes / Code cleanup
+------------------------
+- SIGSEGV crash: Do not check key_state buffers that are in S_UNDEF state
+  (Github #449) - the new sanity check function introduced in 2.6.7
+  sometimes tried to use a NULL pointer after an unsuccessful TLS handshake
+
+- Windows: --dns option did not work when tap-windows6 driver was used,
+  because internal flag for "apply DNS option to DHCP server" wasn't set
+  (Github #447)
+
+- Windows: fix status/log file permissions, caused by regression after
+  changing to CMake build system (Github: #454, Trac: #1430)
+
+- Windows: fix --chdir failures, also caused by error in CMake build system
+  (Github #448)
+
+- doc: fix typos in documentation
+
+User visible changes
+--------------------
+- Windows: print warning if pushed options require DHCP (e.g. DOMAIN-SEARCH)
+  and driver in use does not use DHCP (wintun, dco).
+
+
 Overview of changes in 2.6.7
 ============================
 
diff --git a/version.m4 b/version.m4
index 5ab43dbb1fc..97e536a056c 100644
--- a/version.m4
+++ b/version.m4
@@ -3,12 +3,12 @@ define([PRODUCT_NAME], [OpenVPN])
 define([PRODUCT_TARNAME], [openvpn])
 define([PRODUCT_VERSION_MAJOR], [2])
 define([PRODUCT_VERSION_MINOR], [6])
-define([PRODUCT_VERSION_PATCH], [.7])
+define([PRODUCT_VERSION_PATCH], [.8])
 m4_append([PRODUCT_VERSION], [PRODUCT_VERSION_MAJOR])
 m4_append([PRODUCT_VERSION], [PRODUCT_VERSION_MINOR], [[.]])
 m4_append([PRODUCT_VERSION], [PRODUCT_VERSION_PATCH], [[]])
 define([PRODUCT_BUGREPORT], [openvpn-users@lists.sourceforge.net])
-define([PRODUCT_VERSION_RESOURCE], [2,6,7,0])
+define([PRODUCT_VERSION_RESOURCE], [2,6,8,0])
 dnl define the TAP version
 define([PRODUCT_TAP_WIN_COMPONENT_ID], [tap0901])
 define([PRODUCT_TAP_WIN_MIN_MAJOR], [9])