Cognition Open-Sources an Agent Plugin that Helps Secure Systems against Recent Cybersecurity Threats

Cognition has released the Devin Vulnerability Fixes plugin as a free, open-source set of agent skills. The bundle is aimed at three serious remote code execution advisories: PHP2Shell, the Node.js October 21, 2026 security release, and a GitLab bug scored CVSS 10.0.

The idea is simple enough. Cognition took the remediation flow it already used internally and turned it into reusable skills: inventory the affected systems, ask for approval, patch, test, then open one pull request per repository. The plugin ships as three skills: fix-php-vuln, fix-node-vuln and fix-gitlab-vuln.

It is not tied to Devin alone. Cognition says it works in any coding agent that reads SKILL.md files, including Claude Code, Codex, Cursor, Factory Droid, GitHub Copilot, Gemini CLI, OpenCode and Windsurf. The source is on GitHub under the MIT license, and the product page calls it free and open source. To run it, users need git, a shell, Docker and registry access; the npx install path also needs Node.js 22.20 or later.

The coverage is focused on runtime and infrastructure layers, not just application dependencies. The skills scan Dockerfiles, base images, distro packages, CI, Helm, Terraform, Packer, Lambda and config management. They also try to catch common patching traps, like Debian and Ubuntu backports that keep the upstream version string unchanged, or digest-pinned images that need a new digest instead of a package bump.

On the security side, the targets are specific. PHP2Shell includes two CVE-2026-109618 and CVE-2026-109619 flaws, both rated CVSS v4.0 9.2. The Node.js release fixes 10 CVEs, including CVE-2026-111497, a Brotli decoder out-of-bounds write that can enable RCE. GitLab CVE-2026-110264 is an integer overflow in the regular expression compiler that allows unauthenticated code execution, and GitLab.com plus GitLab Dedicated are already patched. Cognition is not claiming magic here: it says there’s no published remediation benchmark, and the result still depends on the quality of the test suite.