Cognition has released the Devin Vulnerability Fixes plugin, a free, open-source set of agent skills. It targets three critical remote code execution (RCE) advisories. They cover PHP2Shell, the Node.js October 21, 2026 security release and a CVSS 10.0 self-managed GitLab bug. The skills run in Devin and in any coding agent that reads SKILL.md files. Cognition packaged the remediation workflow it used internally. Developers can do inventory, approve, patch, test, then ship 1 pull request per repository.
TL;DR
- Size: Three skills (
fix-php-vuln,fix-node-vuln,fix-gitlab-vuln), MIT license. - Runs on: Devin, Claude Code, Codex, Cursor, Factory Droid, GitHub Copilot, Gemini CLI, OpenCode and Windsurf. Needs git, a shell, Docker and registry access. The
npx skillsinstall needs Node.js 22.20 or later. - Performance: No remediation benchmark or fix-rate number is published for the plugin.
- Best: Covers the week’s most severe bug, GitLab CVE-2026-110264, rated CVSS 10.0.
- Worst: Validation is only as strong as your tests. Managed runtimes, appliances and Electron apps are flagged, not patched.
What is the Devin Vulnerability Fixes plugin?
The Devin Vulnerability Fixes plugin is a set of three Agent Skills from Cognition. They find and patch vulnerable PHP, Node.js and self-managed GitLab deployments. The source is on GitHub under the MIT license. Cognition’s product page lists it as free and open source.
Which vulnerabilities does it fix?
- PHP2Shell (CVE-2026-109618, CVE-2026-109619): PHP rates both flaws CVSS v4.0 9.2. The first corrupts memory after an out-of-memory condition. The second lets stale global state from one request reach the next. PHP says every web-serving setup is at risk, with mod_php rated highest risk. Fixed versions are 8.2.35, 8.3.36, 8.4.27 and 8.5.12. PHP 8.1 and older get no releases, only source backports for 7.4, 8.0 and 8.1.
- Node.js October 2026 release: It fixes 10 CVEs, 4 rated High. The lead bug, CVE-2026-111497, is a Brotli decoder out-of-bounds write that can enable RCE. Fixed versions are 22.23.4, 24.22.1 and 26.12.1. Node.js 20 and older are end-of-life and get no fix.
- GitLab CVE-2026-110264: An integer overflow in the regular expression compiler allows unauthenticated code execution. It affects GitLab CE/EE from 7.0 onward and scores CVSS 10.0. GitLab.com and GitLab Dedicated are already patched.
How does the plugin work?
Every skill follows the same five-step shape:
- Read-only inventory: The agent scans Dockerfiles, base images, distro packages, CI, Helm, Terraform, Packer, Lambda and config management.
- Approval gate: Nothing changes until you pick repos. Riskier minor or major upgrades are called out first.
- Verified target: Every tag, digest, package version and checksum is confirmed against the official source before editing.
- Test before and after: The suite runs on the current version, then inside the new production image. Regressions stop the run.
- One PR per repo: Each PR carries versions, test results, runtime diffs, a risk label and a rollback plan.
The skills also encode known patching traps. Debian and Ubuntu backport fixes without changing upstream versions, so php -v can mislead. Ubuntu 24.04’s fixed package is 8.3.6-0ubuntu0.24.04.13. Digest-pinned images need a new digest. Changing Composer’s require.php patches nothing.
How do you install and run it?
In Devin, open Customize, then Plugins, then Browse Marketplace, and search for Vulnerability Fixes. The Devin CLI uses devin plugins install CognitionAI/devin-marketplace#plugins/devin-vuln-fixes. For other agents, run npx skills add CognitionAI/devin-vuln-fixes. Claude Code users can add the marketplace and run /plugin install vuln-fixes@cognition-skills.
Then ask in plain language, such as ‘Please fix my PHP vulnerability.’ Slash commands also work: /fix-php-vuln, /fix-node-vuln and /fix-gitlab-vuln.
How does it compare with Dependabot, Copilot Autofix and Snyk Agent Fix?
| Feature | Devin Vulnerability Fixes | Dependabot security updates | GitHub Copilot Autofix | Snyk Agent Fix |
|---|---|---|---|---|
| What it fixes | PHP, Node.js and self-managed GitLab versions for 3 advisories | Vulnerable dependencies with an available patch, plus GitHub Actions | Code scanning alerts | Snyk Code findings |
| Where it edits | Dockerfiles, images, distro packages, CI, Helm, Terraform, config management | Manifest and lock files | Code suggestions in the repo | Local-file code fixes; no complex inter-file logic |
| Approval before edits | Yes, read-only inventory first | No: opens PRs automatically once enabled | Not disclosed | User clicks “Generate AI fix” and reviews |
| Validation | Tests before and after inside the new production image | Compatibility scores from public CI runs | Not disclosed | Retests fix with the Snyk Code engine |
| Runs where | Any agent that reads SKILL.md | GitHub | GitHub | Snyk web UI and IDE plugins |
| License | MIT, open source | Not disclosed | Not disclosed | Not disclosed |
| Cost | Free | Available for all GitHub repositories | Free on public repos; private repos need GitHub Code Security | Requires Snyk Code; price not disclosed |
These tools solve adjacent problems. Dependabot and the code-fix agents work on application dependencies and source code. Cognition’s plugin targets the runtime layer: base images, OS packages and infrastructure-as-code.
Key Takeaways
- Three MIT-licensed skills patch PHP2Shell, Node.js and GitLab CVE-2026-110264.
- Read-only inventory and an approval gate come before any edit.
- Tests run before and after inside the new production image.
- Works across Devin, Claude Code, Codex, Cursor and other SKILL.md agents.
- No published fix-rate benchmark; results depend on your test coverage.
Check out the GitHub repo, the Cognition blog post and the plugin page. Also, feel free to follow us on Twitter and don’t forget to join our 150k+ML SubReddit and Subscribe to our Newsletter. Wait! are you on telegram? now you can join us on telegram as well.
Need to partner with us for promoting your GitHub Repo OR Hugging Face Page OR Product Release OR Webinar etc.? Connect with us
The post Cognition Open-Sources an Agent Plugin that Helps Secure Systems against Recent Cybersecurity Threats appeared first on MarkTechPost.