Cognition open-sources agent skills that patch PHP2Shell, Node.js and GitLab flaws

What Cognition released

Cognition, the company behind the Devin coding agent, has open-sourced a plugin meant to help teams patch three critical remote code execution flaws disclosed on 21 October 2026. In a blog post dated 22 October, the company said it packaged the remediation workflow it used on its own systems into a plugin for Devin and for any other coding agent. It is called Vulnerability Fixes, and Cognition's product page describes it as free and open source.

The code lives in the CognitionAI/devin-vuln-fixes repository on GitHub under the MIT License. The repository was created on 22 October, and its changelog lists version 1.0.0 as the first public release on the same day, with fixed-version targets taken from the vendor advisories of 21 October. It holds three skills: fix-php-vuln, fix-node-vuln and fix-gitlab-vuln.

A skill here is a folder with a SKILL.md file of instructions that an agent reads when a task matches its description. There is no new model or scanner behind the plugin. What Cognition is shipping is a detailed, step-by-step playbook that tells an agent how to find vulnerable deployments, what to check before changing anything, and what a finished fix should look like.

The three bugs it targets

The first skill covers PHP2Shell, a pair of unauthenticated remote code execution flaws in the PHP runtime, CVE-2026-109618 and CVE-2026-109619, which AI Lookout covered when PHP shipped patches for the two PHP2Shell flaws. Cognition's post rates them CVSS v4 9.2 and lists the fixed versions as PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. PHP 8.1 and older get no new releases, though PHP published source-level backports for 7.4, 8.0 and 8.1.

The second targets the Node.js security release of 21 October, which Cognition says fixes 10 CVEs, four of them rated High. The most serious is CVE-2026-111497, an out-of-bounds write in the Brotli decoder that can lead to remote code execution, the same bug behind our report that OpenAI's agents found a Brotli flaw affecting Node.js and Python apps. The fixed Node.js lines are 22.23.4, 24.22.1 and 26.12.1. Node.js 20 and older are end of life, get no fix and need a major upgrade.

The third skill handles CVE-2026-110264 in self-managed GitLab, which the skill file describes as a CVSS 10.0 unauthenticated code execution bug caused by an integer overflow in the Onigmo regular expression compiler, affecting every Community and Enterprise edition from 7.0. Fixed releases run from 19.5.1 back to 18.11.13. GitLab.com and GitLab Dedicated are already patched, so the skill only deals with installs that customers run themselves.

How the skills work

All three skills follow the same five steps. First comes a read-only inventory: the agent searches every repository it can reach for places where PHP, Node.js or GitLab is pinned, including Dockerfiles and base images, distribution packages, source builds, CI settings such as setup-node or .nvmrc files, Helm values, Terraform, Packer, AWS Lambda runtimes and Ansible, Chef or Puppet code. It reports what it found, what is affected and what is already fixed.

Second, the agent stops and asks. The user picks which repositories to patch, and the agent has to flag anything riskier than a patch-level bump, such as a minor or major version upgrade, a change of base operating system or a likely change to application code. Third, it patches to a verified target, checking each tag, image digest, package version and checksum against the official registry, vendor advisory or php.net before editing build files.

Fourth, it tests before and after. Cognition says the agent runs the existing test suite on the current version to get a baseline, runs it again inside the new production image, compares the two runtimes, starts the container and checks real responses. If something regresses, it stops and proposes the smallest fix. Finally, it opens one pull request per repository with before and after versions, test results, runtime differences, a risk label and a rollout and rollback plan.

The post also lists traps the skills are written to avoid. Debian and Ubuntu backport fixes without changing the upstream version number, so php -v can still report an old version on a patched server. Images pinned by digest need a new digest rather than a new tag, and changing the PHP version in Composer settings does not change the PHP that runs in production.

Using it outside Devin

Inside Devin, the plugin installs from the Devin Marketplace, and users then ask it in plain language to fix a PHP, Node.js or GitLab vulnerability, or call a skill directly with a slash command. Devin replies with a table of every deployment it found and waits for approval.

For other tools, Cognition built the plugin from standard Agent Skills. Its post says it works with the npx skills installer, so a single command, npx skills add CognitionAI/devin-vuln-fixes, can install it for Claude Code, Codex, Cursor, Factory Droid, GitHub Copilot, Gemini CLI and OpenCode. The installer needs Node.js 22.20 or later. Claude Code and Factory Droid users can also add it as a plugin marketplace, and anyone can copy a skill folder by hand. MarkTechPost's write-up also notes that the skills run in any agent that reads SKILL.md files.

The agent needs git, a shell and read access to the repositories. The build and test steps also need Docker and access to the image registry or package mirror the team's CI already uses. If public hosts are blocked, the skills mark the target version as unverified in the pull request and leave CI to confirm it.

What the skills will not do

Cognition is careful about limits. The agent can only validate what a project's tests cover, and for lightly tested applications the pull request says so and recommends a staging or canary rollout. Managed runtimes, which their provider patches, are reported with a check to run rather than marked as fixed. Vendor appliances and Electron apps that bundle their own PHP or Node.js are flagged for vendor updates instead of being patched in place.

A pull request is also not a fix. The company stresses that nothing changes until the new build is deployed, so every patched service has to be redeployed and anything on a floating image tag rebuilt. For PHP it goes further, saying the bugs are being actively exploited by automated means and that teams should take PHP web applications down while they work on the problem.

The company also warns against running the skills blindly in other products. Many of those tools run locally without the isolation Devin provides, and skills run with the agent's full permissions, so Cognition tells users to review any skill before running it. Neither Cognition nor MarkTechPost published figures on how often the skills produce a correct patch.

Why Cognition is doing this

The plugin is a marketing vehicle as well as a public service. The product page sits under Devin for Security and promotes a webinar with Cognition's chief security officer, Alex Stamos, on 26 October. AI security tooling is crowded: Chainguard recently opened a waitlist for Harness, a Claude Mythos 5.1 vulnerability hunter, and GitHub has long offered Dependabot updates and Copilot Autofix for code scanning alerts.

Cognition's pitch is that the hard part of an urgent patch is not the version bump but finding every place a runtime hides and proving the upgrade does not break anything. Its post argues that critical, easily exploited flaws in foundational software are now a new normal, because AI speeds up both vulnerability discovery and attackers' ability to automate their attacks. It recommends cutting the external attack surface, moving to current runtimes and containers, and treating 30-day patch cycles as too slow.

What to watch

The fixed-version lists are pinned to the advisories of 21 October, so their usefulness depends on Cognition keeping them current as vendors ship further releases. The company tells users of the standalone skills to run npx skills update to pick up new fixed versions.

The bigger test is whether teams trust an agent to edit infrastructure code across dozens of repositories during an incident. The approval gate and one pull request per repository are designed to keep a human in charge, but the quality of each fix will still depend on test coverage that many older PHP and Node.js applications lack. Teams on supported runtime lines have the easiest path. Those on end-of-life versions face major upgrades that no playbook can make risk-free.