Cognition Open-Sources Devin Vulnerability Fixes Plugin, Covering Three High-Severity Vulnerability Categories in PHP, Node.js, and GitLab
Cognition has released the open-source, free Devin Vulnerability Fixes plugin, which includes three Agent skills—fix-php-vuln, fix-node-vuln, and fix-gitlab-vuln—under the MIT license, targeting PHP2Shell, the Node.js October security release, and the self-managed GitLab vulnerability CVE-2026-110264 with a CVSS score of 10.0. The skills execute in five steps: read-only inventory, approval, target version verification, before-and-after testing, and one PR per repository. They can run in agents that read SKILL.md, such as Devin, Claude Code, Codex, Cursor, and GitHub Copilot, and require git, shell, Docker, and image registry access; npx installation requires Node.js 22.20 or later. The original article does not publish a fix-rate benchmark; hosted runtimes, all-in-one machines, and Electron applications are only flagged and not patched.
Why read this
AI score 72
The original article details the specific workflows of the three vulnerability-fixing skills and how to install them across agents, allowing readers to assess whether runtime-layer patches can be integrated into existing workflows.
Topics
Body
Add as a preferredsource on Google
Cognition has released the Devin Vulnerability Fixes plugin, a free, open-source set of agent skills. It targets three critical remote code execution (RCE) advisories. They cover PHP2Shell, the Node.js October 21, 2026 security release and a CVSS 10.0 self-managed GitLab bug. The skills run in Devin and in any coding agent that reads SKILL.md files. Cognition packaged the remediation workflow it used internally. Developers can do inventory, approve, patch, test, then ship 1 pull request per repository.
TL;DR
Size: Three skills (fix-php-vuln, fix-node-vuln, fix-gitlab-vuln), MIT license.
Runs on: Devin, Claude Code, Codex, Cursor, Factory Droid, GitHub Copilot, Gemini CLI, OpenCode and Windsurf. Needs git, a shell, Docker and registry access. The npx skills install needs Node.js 22.20 or later.
Performance: No remediation benchmark or fix-rate number is published for the plugin.
Best: Covers the week’s most severe bug, GitLab CVE-2026-110264, rated CVSS 10.0.
Worst: Validation is only as strong as your tests. Managed runtimes, appliances and Electron apps are flagged, not patched.
What is the Devin Vulnerability Fixes plugin?
The Devin Vulnerability Fixes plugin is a set of three Agent Skills from Cognition. They find and patch vulnerable PHP, Node.js and self-managed GitLab deployments. The source is on GitHub under the MIT license. Cognition’s product page lists it as free and open source.
TEXTTABLELAYOUTIs your PDF parser actually getting it right?omni_parse_bench · scores text, tables & layout · open sourceStar on GitHub→Sponsored
Which vulnerabilities does it fix?
PHP2Shell (CVE-2026-109618, CVE-2026-109619): PHP rates both flaws CVSS v4.0 9.2. The first corrupts memory after an out-of-memory condition. The second lets stale global state from one request reach the next. PHP says every web-serving setup is at risk, with mod_php rated highest risk. Fixed versions are 8.2.35, 8.3.36, 8.4.27 and 8.5.12. PHP 8.1 and older get no releases, only source backports for 7.4, 8.0 and 8.1.
Node.js October 2026 release: It fixes 10 CVEs, 4 rated High. The lead bug, CVE-2026-111497, is a Brotli decoder out-of-bounds write that can enable RCE. Fixed versions are 22.23.4, 24.22.1 and 26.12.1. Node.js 20 and older are end-of-life and get no fix.
GitLab CVE-2026-110264: An integer overflow in the regular expression compiler allows unauthenticated code execution. It affects GitLab CE/EE from 7.0 onward and scores CVSS 10.0. GitLab.com and GitLab Dedicated are already patched.
How does the plugin work?
Every skill follows the same five-step shape:
Read-only inventory: The agent scans Dockerfiles, base images, distro packages, CI, Helm, Terraform, Packer, Lambda and config management.
Approval gate: Nothing changes until you pick repos. Riskier minor or major upgrades are called out first.
Verified target: Every tag, digest, package version and checksum is confirmed against the official source before editing.
Test before and after: The suite runs on the current version, then inside the new production image. Regressions stop the run.
One PR per repo: Each PR carries versions, test results, runtime diffs, a risk label and a rollback plan.
The skills also encode known patching traps. Debian and Ubuntu backport fixes without changing upstream versions, so php -v can mislead. Ubuntu 24.04’s fixed package is 8.3.6-0ubuntu0.24.04.13. Digest-pinned images need a new digest. Changing Composer’s require.php patches nothing.
How do you install and run it?
In Devin, open Customize, then Plugins, then Browse Marketplace, and search for Vulnerability Fixes. The Devin CLI uses devin plugins install CognitionAI/devin-marketplace#plugins/devin-vuln-fixes. For other agents, run npx skills add CognitionAI/devin-vuln-fixes. Claude Code users can add the marketplace and run /plugin install vuln-fixes@cognition-skills.
Then ask in plain language, such as ‘Please fix my PHP vulnerability.’ Slash commands also work: /fix-php-vuln, /fix-node-vuln and /fix-gitlab-vuln.
How does it compare with Dependabot, Copilot Autofix and Snyk Agent Fix?
What it fixesPHP, Node.js and self-managed GitLab versions for 3 advisoriesVulnerable dependencies with an available patch, plus GitHub ActionsCode scanning alertsSnyk Code findings
Where it editsDockerfiles, images, distro packages, CI, Helm, Terraform, config managementManifest and lock filesCode suggestions in the repoLocal-file code fixes; no complex inter-file logic
Approval before editsYes, read-only inventory firstNo: opens PRs automatically once enabledNot disclosedUser clicks “Generate AI fix” and reviews
ValidationTests before and after inside the new production imageCompatibility scores from public CI runsNot disclosedRetests fix with the Snyk Code engine
Runs whereAny agent that reads SKILL.mdGitHubGitHubSnyk web UI and IDE plugins
LicenseMIT, open sourceNot disclosedNot disclosedNot disclosed
CostFreeAvailable for all GitHub repositoriesFree on public repos; private repos need GitHub Code SecurityRequires Snyk Code; price not disclosed
These tools solve adjacent problems. Dependabot and the code-fix agents work on application dependencies and source code. Cognition’s plugin targets the runtime layer: base images, OS packages and infrastructure-as-code.
Key Takeaways
Three MIT-licensed skills patch PHP2Shell, Node.js and GitLab CVE-2026-110264.
Read-only inventory and an approval gate come before any edit.
Tests run before and after inside the new production image.
Works across Devin, Claude Code, Codex, Cursor and other SKILL.md agents.
No published fix-rate benchmark; results depend on your test coverage.
Michal Sutter+ postsBio ⮌
Michal Sutter is a data science professional with a Master of Science in Data Science from the University of Padova. With a solid foundation in statistical analysis, machine learning, and data engineering, Michal excels at transforming complex datasets into actionable insights.
$uv pip install omni-parse-bench✓text✓tables✓layout→ scored per pageStar on GitHub→Sponsored
RELATED ARTICLESMORE FROM AUTHOR
How to Run Underdog Saluki 27B: 2-Bit Qwen3.8-27B Tool-Calling Guide
Meet Anthropic’s sandbox-runtime: OS-Level Sandboxing for AI Agents, No Containers
NVIDIA Releases Nemotron 3.5 Bolt E4B 4GB: An Open Small Language Model for Local Voice Agents, Game Characters and Robots
Moonshot AI Releases Kimi K3.1 Pro: A 2.8T Total/104B Active Params (MoE) Model with 1M Context