Cognition's Free Devin Plugin Patches PHP2Shell, Node.js and GitLab

On October 21, 2026, PHP and Node.js shipped emergency patches for remote code execution flaws on the same day, and GitLab followed with a fix for a bug carrying the maximum CVSS score of 10.0. Two days later, Cognition — the company behind the Devin coding agent — open-sourced the remediation workflow its own engineers used that week: three free agent skills that find vulnerable PHP, Node.js and self-managed GitLab deployments across your repositories, patch them to verified fixed versions, test before and after, and open one pull request per repo.

In short: Cognition has open-sourced three free agent skills that find and patch the week's worst vulnerabilities — PHP2Shell, the Node.js Brotli flaw and GitLab's CVSS 10.0 bug — across every repo you own. They run in Devin, Claude Code, Codex, Cursor and any agent that reads SKILL.md files. The catch: there is no published fix-rate benchmark, so the patches are only as good as your own test suite.

What the plugin actually is

Devin Vulnerability Fixes is three Agent Skills — small markdown files any coding agent can read — published on GitHub under the MIT license on October 22, 2026. Each skill is self-contained: install all three, or just the one you need.

The design choice that matters is agent-neutrality. The skills work in Devin, Claude Code, Codex, Cursor, Factory Droid, GitHub Copilot, Gemini CLI, OpenCode and Windsurf — and, according to the README, more than 70 other agents that read SKILL.md files. You do not need a Devin subscription to use any of it.

The three flaws it patches

1. PHP2Shell — CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2)

PHP2Shell is a pair of critical flaws in the PHP runtime itself, both rated CVSS v4.0 9.2. CVE-2026-109618 corrupts memory after an out-of-memory condition interrupts request processing while internal data is only partly initialised. CVE-2026-109619 lets stale global state from one request survive after its memory has been freed and be reused by the next. Both allow unauthenticated remote code execution, and PHP's own advisories say every web-serving PHP setup is at risk — PHP-FPM, Apache mod_php (rated the highest risk), php-cgi, FrankenPHP and LiteSpeed.

The fixed versions are 8.2.35, 8.3.36, 8.4.27 and 8.5.12. PHP 8.1 and older get no new releases; PHP published source-level backports for 7.4, 8.0 and 8.1 instead. We covered the full story, including the AI-assisted discovery, in our PHP2Shell analysis — the short version is that this is a runtime bug, so updating WordPress or your framework does nothing. Only the runtime upgrade fixes it. One trap the skill encodes: distro packages backport fixes without changing the upstream version number, so Ubuntu 24.04's fixed package is 8.3.6-0ubuntu0.24.04.13 while php -v still says 8.3.6.

2. Node.js — CVE-2026-111497, the Brotli RCE

The Node.js October 21, 2026 security release fixes 10 CVEs, four rated High. The headline bug, CVE-2026-111497, is an out-of-bounds write in the Brotli decoder bundled with Node.js: a crafted compressed stream can write past the end of an internal decoder buffer, which can lead to remote code execution. The other three High issues — CVE-2026-105482, CVE-2026-105483 and CVE-2026-106069 — are TLS and DNS hostname validation bypasses. Fixed versions are 22.23.4, 24.22.1 and 26.12.1. Node.js 20 and older are end-of-life and will not be fixed; they need a major-version upgrade to 22 or later.

This one is no longer theoretical. Imperva's Threat Research group has demonstrated working remote code execution against Node.js 24.22.0 — the version just before the patch — on Linux arm64, with a marker file appearing inside the Node.js process as proof. The payload travels inside a malformed Brotli stream, reaching the decoder through the built-in fetch(), which automatically decompresses Brotli responses, and through incoming request bodies on Express 5 applications using body-parser 2. On the patched 24.22.1, the same inputs are rejected with a format error. Two honest limits: Imperva tested arm64 only, and the attack took multiple attempts, with each failed attempt crashing the process. The same decoder bug also sits in Bun, Envoy, Istio and the Python brotli packages, which is why the skill's inventory step looks at Dockerfiles and base images rather than just your package.json.

3. GitLab — CVE-2026-110264 (CVSS 10.0)

The third skill covers the highest-scoring bug of the three. CVE-2026-110264 is an integer overflow in the regular expression compiler that allows unauthenticated code execution in self-managed GitLab, affecting GitLab CE and EE from version 7.0 onward and scoring the maximum CVSS 10.0. The fixed releases are 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13. GitLab.com and GitLab Dedicated were already patched by GitLab itself, so this skill is only for teams running their own instances. One sourcing note: GitLab's own advisory page serves a sign-in wall to automated fetches, so these details come from Cognition's README and MarkTechPost's reading of the advisory, which agree on the CVE number, the 10.0 score and the fixed versions.

How it works: five steps, one approval gate

Every skill follows the same five-step shape — the shape is the real product, and the version numbers are just this week's data.

1. Read-only inventory. The agent searches Dockerfiles, base images, distro packages, source builds, CI configuration, Helm charts, Terraform, Ansible, Chef and Puppet, then produces one table: file, current version, pin style, production or CI-only, test coverage, confidence. Nothing changes.
2. Approval gate. Nothing is edited until you pick which repositories to patch. Anything riskier than a patch bump — a minor or major upgrade, a base-OS change, a likely application-code change — is called out first.
3. Patch to a confirmed target. Every tag, digest, package version and checksum is checked against the official registry, vendor advisory or php.net before editing. The agent never guesses versions.
4. Test before and after. The suite runs on the current version for a baseline, then again inside the new production image. New failures and new deprecation warnings count as regressions, and a regression stops the run.
5. One focused PR per repo with before and after versions, digests, test results, a risk label, a rollout plan and a rollback target.

Step four is the one most teams skip when they patch by hand, and it is the one that matters most. Host-side tests miss base-image changes; running the suite inside the built production image is what catches them. And the approval gate is the other half of the design: patching a runtime is a production change, and the skills never edit before you approve a list of repos.

How to install and use it

For any agent that reads SKILL.md files, the install is one command: npx skills add CognitionAI/devin-vuln-fixes. The CLI detects the agents on your machine and asks where to install. Add -g for every project, or pick agents with -a claude-code -a codex -a cursor -a droid -a devin. One skill only: npx skills add CognitionAI/devin-vuln-fixes --skill fix-php-vuln. The installer needs Node.js 22.20 or later — a small irony, given one of the skills patches Node.js itself. Update later with npx skills update.

Claude Code users can run /plugin marketplace add CognitionAI/devin-vuln-fixes then /plugin install vuln-fixes@cognition-skills. In Devin, install Vulnerability Fixes from the plugin marketplace or add the repository on the Customize page. Or install by hand: clone the repo and copy a skill folder into .agents/skills/, .claude/skills/, .devin/skills/, .factory/skills/ or .windsurf/skills/.

Then ask in plain language — "Please fix my PHP vulnerability" — and the agent picks the matching skill. Slash commands work too: /fix-php-vuln, /fix-node-vuln, /fix-gitlab-vuln. To narrow the scope, name the repositories: "Please fix my PHP vulnerability in acme/billing-api and acme/storefront." After the PRs land, review each one's test results and risk label, roll high-risk changes to staging or a canary first, and redeploy every patched service — the fix only takes effect once the new build is deployed.

What it costs

The plugin costs nothing: MIT-licensed, on GitHub, no account, no trial, no usage meter. The agents it runs in are not all free, so here is what the host costs if you do not already have one.

Prices are from Devin's pricing page, read on October 25, 2026. The fine print: the plugin does not require any Devin plan. Run it in Claude Code, Cursor, Codex or OpenCode and you pay whatever that agent already costs you — or nothing, in a free agent. The $0 price tag is real, but it is not a $0 patching operation: the agent's usage still bills through your existing plan, and the human review time is the actual cost. Cognition's paid enterprise sibling, Devin Security Swarm, is a separate product; its company-run benchmark is 72% recall at $90.23 per run — a test of that platform, not of this free plugin.

How it compares with Dependabot, Copilot Autofix and Snyk Agent Fix

These tools solve adjacent problems, not the same one. Dependabot and the code-fix agents work on application dependencies and source code; Cognition's plugin targets the runtime layer — base images, OS packages and infrastructure-as-code. The table adapts MarkTechPost's comparison.

You probably want more than one of these. Dependabot keeps your dependencies current; the Cognition plugin keeps the runtime underneath them current. Neither replaces the other, and neither replaces a human reading the diff on a CVSS 10.0 patch.

Pros and cons

Pros: free and MIT-licensed, no account or subscription; works in nine named agents and dozens more, not locked to Devin; an approval gate means nothing changes before you say so; every version, digest and checksum is verified against the official source; tests run before and after inside the new production image; one focused PR per repo with a risk label and rollback plan.

Cons: no published fix-rate or recall benchmark for the plugin, so its real-world reliability is unproven; validation is only as strong as the test suite you already have; managed runtimes, appliances and Electron apps are flagged, not patched; end-of-life runtimes (Node 20, PHP 8.1 and older) need a major upgrade the skill cannot do for you; fixed versions are pinned to the October 21 advisories, so the skills go stale unless you run npx skills update.

The catch, stated plainly

First, there is no published evidence for how often the plugin gets it right. Cognition publishes no remediation benchmark or fix-rate figure for these skills — no percentage of repos patched cleanly, no regression rate, nothing. The enterprise Security Swarm has a benchmark (72% recall on 50 advisories, company-run); the free plugin has none. A patch that passes your tests is only as trustworthy as those tests, and a team with thin test coverage is exactly the team most likely to lean on an automated patcher.

Second, the urgency is real but the wording is Cognition's. The company's blog says these bugs "are being actively exploited via automated means" and advises taking PHP web applications down immediately while patching. That is strong advice from a vendor with a product in the space. Independent corroboration exists — Cloudflare counted millions of exploitation attempts within hours of PHP2Shell going public, according to an AI Daily Post report, and Imperva has now shown working RCE against unpatched Node.js — but neither proves your deployment is being targeted. Patch fast because the flaws are severe and the fixes are available, not because a vendor told you to panic.

Third, an agent writing patches to your production runtime is a trust decision, not just a convenience. A Tenzai evaluation of five major coding agents — Cursor, Claude Code, Codex, Replit and Devin — found they avoided common flaws like SQL injection and cross-site scripting but struggled with harder issues such as improper authorisation and server-side request forgery. The plugin's approval gate and test-before-and-after steps are designed for exactly that gap, but they only work if a human actually reads the inventory, reviews the PR and checks the diff. The skill that automates patching does not automate accountability.

Who should use it, and who should skip it

Use it if you run PHP, Node.js or self-managed GitLab anywhere — which, for most teams, means somewhere in a Dockerfile or a base image you have not looked at in months — and you have a test suite you trust. The read-only inventory alone is worth the install: it tells you what is vulnerable before you commit to patching anything. Skip it, or do not let it run unsupervised, if your test coverage is thin, if you run managed runtimes or appliances it cannot patch, or if you are on end-of-life versions. Node 20 and PHP 8.1 have no patch to apply; the skill flags them, and then the work is a major-version upgrade — a project, not a pull request.

FAQ

Is the Devin Vulnerability Fixes plugin really free?

Yes. MIT-licensed on GitHub, no account, trial or usage meter, and it runs in any agent that reads SKILL.md files — no Devin subscription required. Devin itself starts at a $0 free tier, with Pro at $20/month, Max at $200/month and Team at $80/month.

Which AI coding agents can run the skills?

Devin, Claude Code, Codex, Cursor, Factory Droid, GitHub Copilot, Gemini CLI, OpenCode and Windsurf, plus more than 70 others in the README. The agent needs read access to your repos, plus Docker and registry access for the build and test steps.

Does it actually patch my code, or just find the problem?

It patches: inventory, approval, verified patch, tests before and after, then one pull request per repository. But the fix only takes effect once you merge the PR, rebuild the image and redeploy — a floating image tag still points at the old image until you rebuild.

What if I am on Node 20 or PHP 8.1?

There is no patch for you. Both are end-of-life: Node 20 gets no security release, and PHP 8.1 gets no new version, only a source backport. The skill flags these deployments; the fix is a major-version upgrade to Node 22 or later, or PHP 8.2 and above.

How is this different from Dependabot?

Dependabot patches application dependencies in manifest and lock files. The Cognition plugin patches the runtime layer underneath them — base images, OS packages, CI configuration and infrastructure-as-code. They cover different layers of the same stack, and most teams need both.

Key takeaways

• Three free MIT-licensed skills patch PHP2Shell, the Node.js Brotli RCE and GitLab CVE-2026-110264 across your repositories.
• A read-only inventory and an approval gate come before any edit — nothing changes until you pick the repos.
• Every version, digest and checksum is verified against the official source before the agent edits anything.
• Tests run before and after inside the new production image, and regressions stop the run.
• No published fix-rate benchmark exists for the plugin, so the patches are only as good as your own test suite — review every diff.

The flaws this plugin patches are from October 21, 2026, and Cognition says they are already being exploited by automated means. Check your runtimes today — the inventory step alone takes minutes, and it tells you whether you are exposed.