# Cognition releases open-source Devin Vulnerability Fixes plugin for PHP, Node.js, GitLab

Digest AI · Agents & Tools · published 2026-10-25T02:59:08Z

Canonical: https://digestai.news/story/cognition-releases-open-source-devin-vulnerability-fixes-plugin-for-ph

## Summary

Cognition has launched the Devin Vulnerability Fixes plugin, a free, MIT‑licensed set of three agent skills that automatically remediate recent remote code execution advisories. The skills address PHP2Shell (CVE‑2026‑109618, CVE‑2026‑109619), the October 2026 Node.js release that fixes ten CVEs including CVE‑2026‑111497, and the GitLab CVE‑2026‑110264 bug rated CVSS 10.0.

The plugin runs on Devin and any coding agent that reads SKILL.md files, including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode and Windsurf. Installation is via the Devin marketplace or the command `npx skills add CognitionAI/devin-vuln-fixes`, and it requires Node.js 22.20+, git, a shell, Docker and registry access. Each skill follows a five‑step workflow—read‑only inventory, approval gate, verified target, pre‑ and post‑test, and a single pull request per repository—but the article notes no published remediation benchmark.

## Key points

- Cognition open‑sourced the Devin Vulnerability Fixes plugin with three MIT‑licensed skills for PHP, Node.js and GitLab RCE bugs.
- The plugin supports agents such as Devin, Claude Code, Codex, Cursor, GitHub Copilot and Gemini CLI, requiring Node.js 22.20+, git, Docker and registry access.
- It follows a five‑step workflow—inventory, approval, verification, test, and single PR per repository—but provides no published fix‑rate benchmark.

## Why it matters

Provides developers with an automated, open‑source way to detect and patch high‑severity runtime vulnerabilities across multiple AI coding assistants, improving supply‑chain security.

## Sources

1. [Cognition Open-Sources an Agent Plugin that Helps Secure Systems against Recent Cybersecurity Threats](https://marktechpost.com/2026/10/24/cognition-devin-vulnerability-fixes-plugin-php2shell-nodejs-gitlab) (MarkTechPost, 2026-10-25)

## Cite

Digest AI, "Cognition releases open-source Devin Vulnerability Fixes plugin for PHP, Node.js, GitLab", 25 October 2026, https://digestai.news/story/cognition-releases-open-source-devin-vulnerability-fixes-plugin-for-ph

---

Written by Digest AI's editorial model from the linked sources; the sources are the record. Headlines, digests and key points are written by Digest AI and may be quoted with a link to the story page. Linked articles belong to their publishers. Terms: https://digestai.news/terms#reuse
JSON: https://digestai.news/story/cognition-releases-open-source-devin-vulnerability-fixes-plugin-for-ph.json