AI News Feed
Market watch
Cognition Open-Sources Devin Vulnerability Fixes Plugin for PHP, Node.js and GitLab RCE FlawsTutorial Tests Underdog Saluki 27B's 2-Bit Tool-Calling Claim Against ISTA QuantizationNew Zealand faces Cook Islands in crucial Rugby League World Cup matchSwitching Fitness Trackers in 2026 Can Preserve Old Health Data, but Cross-Brand Moves Need Manual ExportsTving Tops September Streaming App Installations Despite Data Breach ControversySamsung, SK hynix to report Q3 earnings with AI memory demand in focus
Cognition Open-Sources Devin Vulnerability Fixes Plugin for PHP, Node.js and GitLab RCE FlawsTutorial Tests Underdog Saluki 27B's 2-Bit Tool-Calling Claim Against ISTA QuantizationNew Zealand faces Cook Islands in crucial Rugby League World Cup matchSwitching Fitness Trackers in 2026 Can Preserve Old Health Data, but Cross-Brand Moves Need Manual ExportsTving Tops September Streaming App Installations Despite Data Breach ControversySamsung, SK hynix to report Q3 earnings with AI memory demand in focus
Cybersecurity

Cognition Open-Sources Devin Vulnerability Fixes Plugin for PHP, Node.js and GitLab RCE Flaws

Cognition has open-sourced a free MIT-licensed Devin plugin that patches three critical PHP, Node.js and GitLab RCE flaws.

AI News Feed · 2026-10-25 13:14

The PHP2Shell flaws, CVE-2026-109618 and CVE-2026-109619, are rated CVSS v4.0 9.2 by PHP. One corrupts memory after an out-of-memory condition; the other lets stale global state from one request reach the next. PHP says every web-serving setup is at risk, with mod_php rated highest risk. Fixed versions are 8.2.35, 8.3.36, 8.4.27 and 8.5.12. PHP 8.1 and older receive no releases, only source backports for 7.4, 8.0 and 8.1.

The Node.js October 2026 security release fixes 10 CVEs, four rated High. The lead bug, CVE-2026-111497, is a Brotli decoder out-of-bounds write that can enable RCE. Fixed versions are 22.23.4, 24.22.1 and 26.12.1. Node.js 20 and older are end-of-life and get no fix.

The self-managed GitLab bug, CVE-2026-110264, is an integer overflow in the regular expression compiler that allows unauthenticated code execution. It affects GitLab CE/EE from 7.0 onward and scores CVSS 10.0. GitLab.com and GitLab Dedicated are already patched.

The plugin contains three skills, fix-php-vuln, fix-node-vuln and fix-gitlab-vuln, under the MIT license. It runs on Devin, Claude Code, Codex, Cursor, Factory Droid, GitHub Copilot, Gemini CLI, OpenCode and Windsurf. It needs git, a shell, Docker and registry access; the npx skills install requires Node.js 22.20 or later. No remediation benchmark or fix-rate number is published, and validation is only as strong as the tests used. Managed runtimes, appliances and Electron apps are flagged, not patched, according to the report.

Each skill follows a five-step workflow: read-only inventory of Dockerfiles, base images, distro packages, CI, Helm, Terraform, Packer, Lambda and configuration management; an approval gate before any changes; verification of every tag, digest, package version and checksum against the official source; tests on the current version and inside the new production image, with regressions stopping the run; and one pull request per repository carrying versions, test results, runtime diffs, a risk label and a rollback plan.

The skills encode patching traps. Debian and Ubuntu backport fixes without changing upstream versions, so php -v can mislead; Ubuntu 24.04's fixed package is 8.3.6-0ubuntu0.24.04.13. Digest-pinned images need a new digest, and changing Composer's require.php patches nothing.

In Devin, users can open Customize, then Plugins, then Browse Marketplace and search for Vulnerability Fixes. The Devin CLI uses devin plugins install CognitionAI/devin-marketplace#plugins/devin-vuln-fixes. For other agents, the command is npx skills add CognitionAI/devin-vuln-fixes; Claude Code users can add the marketplace and run /plugin install vuln-fixes@cognition-skills. Users can ask in plain language or use /fix-php-vuln, /fix-node-vuln and /fix-gitlab-vuln.

MarkTechPost's comparison said Dependabot security updates fix vulnerable dependencies with an available patch plus GitHub Actions, GitHub Copilot Autofix addresses code scanning alerts, and Snyk Agent Fix addresses Snyk Code findings. The Devin plugin edits Dockerfiles, images, distro packages, CI, Helm, Terraform and configuration management; it requires a read-only inventory before edits, tests before and after inside the new production image, and is MIT-licensed and free. Dependabot opens pull requests automatically once enabled, according to the comparison, while Copilot Autofix suggests code changes in the repository and Snyk Agent Fix makes local-file code fixes.