Cognition releases open-source Devin Vulnerability Fixes plugin for PHP, Node.js, GitLab
Cognition has launched the Devin Vulnerability Fixes plugin, a free, MIT‑licensed set of three agent skills that automatically remediate recent remote code execution advisories. The skills address PHP2Shell (CVE‑2026‑109618, CVE‑2026‑109619), the October 2026 Node.js release that fixes ten CVEs including CVE‑2026‑111497, and the GitLab CVE‑2026‑110264 bug rated CVSS 10.0.
Key points
- Cognition open‑sourced the Devin Vulnerability Fixes plugin with three MIT‑licensed skills for PHP, Node.js and GitLab RCE bugs.
- The plugin supports agents such as Devin, Claude Code, Codex, Cursor, GitHub Copilot and Gemini CLI, requiring Node.js 22.20+, git, Docker and registry access.
- It follows a five‑step workflow—inventory, approval, verification, test, and single PR per repository—but provides no published fix‑rate benchmark.
The plugin runs on Devin and any coding agent that reads SKILL.md files, including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode and Windsurf. Installation is via the Devin marketplace or the command npx skills add CognitionAI/devin-vuln-fixes, and it requires Node.js 22.20+, git, a shell, Docker and registry access. Each skill follows a five‑step workflow—read‑only inventory, approval gate, verified target, pre‑ and post‑test, and a single pull request per repository—but the article notes no published remediation benchmark.
Cognition Open-Sources an Agent Plugin that Helps Secure Systems against Recent Cybersecurity Threats
MarkTechPost · 25 October 2026
Loading the full article…
This text was published by MarkTechPost and written by Michal Sutter. It is reproduced here with attribution so you can read it in full; the rights remain with the publisher. Read it at the source ↗
The headline, key points and digest above were generated by Digest AI's editorial model from the linked sources. Automated summaries can contain errors: the sources are the record. Spotted a mistake? Tell us. Published by Martin K., who runs Digest AI and handles corrections.
More in Agents & Tools
All →- OpenAI model spends testnet ethereum after locating a recovery phrase · 1 src
- Techcrunch lists AI agents that work over text messages · 1 src
- Simon Willison adds four‑player mode and Compass Rose map to Battledrones · 1 src
- Alera factory builds open-source libraries autonomously · 1 src
- Anthropic releases always-on agent Claude Duet for Pro/Max users · 5 src
Comments
via GitHub Discussions