Cognition has released the Devin Vulnerability Fixes plugin, a free, open-source set of agent skills designed to help secure systems against recent cybersecurity threats.
Key points
- Cognition open-sourced the Devin Vulnerability Fixes plugin for cybersecurity.
- Plugin targets PHP2Shell, Node.js, and GitLab remote code execution flaws.
- It includes three agent skills under the MIT license.
- The plugin is compatible with multiple AI coding agents.
This plugin targets three critical remote code execution (RCE) advisories, including PHP2Shell, a Node.js security release from October 2026, and a self-managed GitLab bug with a CVSS 10.0 rating.
The plugin's skills can run within Cognition's Devin AI agent and any other coding agent that can read SKILL.md files. Cognition has packaged its internal remediation workflow, allowing developers to perform inventory, approval, patching, testing, and then ship a single pull request per repository.
By the numbers
- GitLab bug CVSS rating
- 10.0
- PHP2Shell flaws CVSS v4.0 rating
- 9.2
The Devin Vulnerability Fixes plugin is available under the MIT license and includes three skills: fix-php-vuln, fix-node-vuln, and fix-gitlab-vuln. It is compatible with various platforms including Devin, Claude Code, Codex, Cursor, Factory Droid, GitHub Copilot, Gemini CLI, OpenCode, and Windsurf, requiring git, a shell, Docker, registry access, and Node.js 22.20 or later.
The plugin addresses PHP2Shell vulnerabilities (CVE-2026-109618, CVE-2026-109619), both rated CVSS v4.0 9.2, which affect web-serving setups with mod_php at highest risk. It also fixes 10 CVEs in the Node.js October 2026 release, including CVE-2026-111497, a Brotli decoder issue. The most severe bug covered is GitLab CVE-2026-110264, rated CVSS 10.0.
Sources and references
Original report
Cognition Open-Sources an Agent Plugin that Helps Secure Systems against Recent Cybersecurity Threats
MarkTechPost
Read on MarkTechPost (opens in a new tab)Linked in the original report
- Linkdevin.ai/security/vulnerability-fixes (opens in a new tab)
- Linkphp.net/archive/2026.php (opens in a new tab)
- Linknodejs.org/en/blog/vulnerability/october-2026-secu… (opens in a new tab)
- Codedocs.gitlab.com/releases/patches/patch-release-gitlab-1… (opens in a new tab)
- Codegithub.com/CognitionAI/devin-vuln-fixes (opens in a new tab)
- Linkdevin.ai/blog/vulnerability-fixes-plugin (opens in a new tab)
Ref 00UV2485
Cite this
APA
Interestana AI Editorial. (2026, October 25). Cognition Open-Sources AI Agent Plugin for Cybersecurity Fixes. Interestana. https://interestana.com/articles/cognition-open-sources-an-agent-plugin-that-helps-secure-systems-against-recent-cybersecurity-threats-00uv2485
MLA
“Cognition Open-Sources AI Agent Plugin for Cybersecurity Fixes.” Interestana, 25 Oct. 2026, interestana.com/articles/cognition-open-sources-an-agent-plugin-that-helps-secure-systems-against-recent-cybersecurity-threats-00uv2485.
Chicago
Interestana AI Editorial. “Cognition Open-Sources AI Agent Plugin for Cybersecurity Fixes.” Interestana, October 25, 2026. https://interestana.com/articles/cognition-open-sources-an-agent-plugin-that-helps-secure-systems-against-recent-cybersecurity-threats-00uv2485.
BibTeX
@misc{interestana_00uv2485,
author = {{Interestana AI Editorial}},
title = {{Cognition Open-Sources AI Agent Plugin for Cybersecurity Fixes}},
howpublished = {Interestana},
year = {2026},
month = oct,
url = {https://interestana.com/articles/cognition-open-sources-an-agent-plugin-that-helps-secure-systems-against-recent-cybersecurity-threats-00uv2485},
note = {Summary of reporting by MarkTechPost, https://www.marktechpost.com/2026/10/24/cognition-devin-vulnerability-fixes-plugin-php2shell-nodejs-gitlab/}
}Credit the source
Original reporting: MarkTechPost, “Cognition Open-Sources an Agent Plugin that Helps Secure Systems against Recent Cybersecurity Threats”, https://www.marktechpost.com/2026/10/24/cognition-devin-vulnerability-fixes-plugin-php2shell-nodejs-gitlab/(opens in a new tab)
Follow this story
Get Cybersecurity in your inbox — new stories in 40 words or fewer, once a week.
Subscribe