Cognition拥有Devin Voblicity Fixes插件的发布，是一套免费的，开源的agent技能。 它针对三个关键的远程代码执行建议。 它们覆盖了PHP2Shell,Node.js October 21, 2026安全发布以及一个CVSS 10.0 自我管理的 GitLab bug. 技能在Devin和任何读取SKILL.md文件的编码agent中运行。 Cognition对内部使用的补救工作流程进行了包装。 开发者可以进行库存，批准，补丁，测试，然后每个寄存器发送1拉请求。
TL；数据
- 大小：三种技能(fix-php-vuln,fix-node-vuln,fix-gitlab-vuln)，麻省理工学院许可证。
- 运行于：德文，Claude Code,Codex,Cursor，工厂机器人，GitHub Copilot,Gemini CLI,OpenCode和Windsurf. 需要 git, a shell, Docker 和注册访问。 npx技能安装需要Node.js 22.20或以后。
- 性能：该插件没有公布基准测试或固定速率编号。
- 最佳：覆盖本周最严重的bug,GitLab CVE-2026-110264，评级为CVSS 10.0.
- 最糟糕的：验证只是你的测试管理下的运行时间，电器和Electron应用被标记，而不是补丁。
什么是“Devin脆弱性修复”插件？
Devin Voblicity Fixes插件是一套来自Cognition的三款Agent技能。 他们发现并补齐了脆弱的PHP,Node.js和自我管理的GitLab部署。 消息来源于麻省理工学院许可下的GitHub. Cognition的产品页将其列为免费和开源。
它能解决哪些弱点？
- PHP2Shell(CVE-2026-109618,CVE-2026-109619):PHP评分两处缺陷 CVSS v4.0 9.2. 最早的破坏记忆后一个超记忆状态。 第二点让全球国家从一个请求到下一个请求。 PHP 称每个网络服务设置都面临风险，mod php评分最高的风险。 固定版本为8.2.35,8.3.36,8.4.27和8.5.12. PHP 8.1及更年长者获得无发布，只获得7.4,8.0和8.1的源背口。
- Node.js 2026年10月发布：它修正了10个CVE,4个评分高。 铅虫CVE-2026-111497是一种Brotli解码器出界书写，可以启用RCE. 固定版本为22.23.4,24.22.1和26.12.1. 20及更年长的节点js是报废的，没有固定。
- GitLab CVE-2026-110264：正则表达式编译器中的整数溢出允许未经认证的代码执行。 它从7.0起影响GitLab CE/EE，并得分CVSS 10.0. GitLab.com和GitLab Dedited已经补齐。
插件是如何工作的？
每个技能都遵循相同的五步形状：
- 仅读目录：agent扫描Dockerfiles，基础图像，Distro包，CI,Helm,Terraform,Packer,Lambda和配置管理。
- 批准门：除非你选回，否则不会有什么变化。 比较危险的小或重大升级首先被叫出来。
- 验证目标：在编辑前，对照官方来源确认每个标签、文摘、软件包版本和核对和。
- 前后试验：套房运行在目前版本上，然后在新制作的图像内。 退转止奔。
- 每回1个PR：每个PR携带版本，测试结果，运行时间diffs，一个风险标签和一个回滚计划。
这些技能还编码了已知的补丁陷阱。 Debian和Ubuntu的后端port不改变上游版本而修正，因此php -v可以误导。 Ubuntu 24.04的固定货包为8.3.6-0ubuntu0.24.04.13. 文摘标注的图像需要一个新的文摘。 更改作曲家的要求.php 没有任何补丁。
如何安装和运行它？
在 Devin 中，打开自定义，然后是插件，然后浏览 Marketplace，并搜索易碎的 Fixes。 Devin CLI使用devin插件安装 CognitionAI/devin-marketplace#plugins/devin-vuln-fixes. 对于其他agents，运行npx技能则会加入CognitionAI/devin-vuln-fixes. Claude Code用户可以添加市场并运行/plugin安装vuln-fixes@cognition-技能。
那就用简单的语言问，例如“请解决我的PHP弱点。” 斜线命令也工作：/fix-php-vuln,/fix-node-vuln和/fix-gitlab-vuln.
它与Depabot,Copilot自动固定和SnykZAgent Fix有什么比较？
这些工具解决了相邻的问题。 Dependabot和代码-fix agents在应用依赖性和源代码方面的工作。 兹Q 1Z的插件针对运行时层：基础图像，OS包和基础设施-as-code.
关键外卖
- 三个麻省理工学院许可技能补丁PHP2Shell,Node.js和GitLab CVE-2026-110264。
- 仅读库存和批准大门在编辑之前就到。
- 测试在新制作图像前后进行。
- 工程跨越德文，Claude Code,Codex,Cursor和其他SKILL.md agents.
- 没有公布的固定速率基准测试；结果取决于你的测试范围。
请检查access-date=中的日期值 (帮助) GitHub repo, Cognition博客帖和插件页面。 并加入我们的通讯。 等等你在电报里吗现在你也可以加入我们的电报。
需要和我们合作推广您的 GitHub Repo OR Hugging Face Page OR Product Release OR Webinar 等吗？联系我们
米哈尔·萨特(Michal Sutter)是一名数据科学专业人员，拥有帕多瓦大学的数据科学硕士学位。 在统计分析、机器学习和数据工程方面有一个坚实的基础，Michal在将复杂的数据集转化为可操作的见解方面表现突出。
本文由 AI图鉴自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
Cognition has released the Devin Vulnerability Fixes plugin, a free, open-source set of agent skills. It targets three critical remote code execution (RCE) advisories. They cover PHP2Shell, the Node.js October 21, 2026 security release and a CVSS 10.0 self-managed GitLab bug. The skills run in Devin and in any coding agent that reads SKILL.md files. Cognition packaged the remediation workflow it used internally. Developers can do inventory, approve, patch, test, then ship 1 pull request per repository.
TL;DR
- Size: Three skills (fix-php-vuln, fix-node-vuln, fix-gitlab-vuln), MIT license.
- Runs on: Devin, Claude Code, Codex, Cursor, Factory Droid, GitHub Copilot, Gemini CLI, OpenCode and Windsurf. Needs git, a shell, Docker and registry access. The npx skills install needs Node.js 22.20 or later.
- Performance: No remediation benchmark or fix-rate number is published for the plugin.
- Best: Covers the week’s most severe bug, GitLab CVE-2026-110264, rated CVSS 10.0.
- Worst: Validation is only as strong as your tests. Managed runtimes, appliances and Electron apps are flagged, not patched.
What is the Devin Vulnerability Fixes plugin?
The Devin Vulnerability Fixes plugin is a set of three Agent Skills from Cognition. They find and patch vulnerable PHP, Node.js and self-managed GitLab deployments. The source is on GitHub under the MIT license. Cognition’s product page lists it as free and open source.
Which vulnerabilities does it fix?
- PHP2Shell (CVE-2026-109618, CVE-2026-109619): PHP rates both flaws CVSS v4.0 9.2. The first corrupts memory after an out-of-memory condition. The second lets stale global state from one request reach the next. PHP says every web-serving setup is at risk, with mod_php rated highest risk. Fixed versions are 8.2.35, 8.3.36, 8.4.27 and 8.5.12. PHP 8.1 and older get no releases, only source backports for 7.4, 8.0 and 8.1.
- Node.js October 2026 release: It fixes 10 CVEs, 4 rated High. The lead bug, CVE-2026-111497, is a Brotli decoder out-of-bounds write that can enable RCE. Fixed versions are 22.23.4, 24.22.1 and 26.12.1. Node.js 20 and older are end-of-life and get no fix.
- GitLab CVE-2026-110264: An integer overflow in the regular expression compiler allows unauthenticated code execution. It affects GitLab CE/EE from 7.0 onward and scores CVSS 10.0. GitLab.com and GitLab Dedicated are already patched.
How does the plugin work?
Every skill follows the same five-step shape:
- Read-only inventory: The agent scans Dockerfiles, base images, distro packages, CI, Helm, Terraform, Packer, Lambda and config management.
- Approval gate: Nothing changes until you pick repos. Riskier minor or major upgrades are called out first.
- Verified target: Every tag, digest, package version and checksum is confirmed against the official source before editing.
- Test before and after: The suite runs on the current version, then inside the new production image. Regressions stop the run.
- One PR per repo: Each PR carries versions, test results, runtime diffs, a risk label and a rollback plan.
The skills also encode known patching traps. Debian and Ubuntu backport fixes without changing upstream versions, so php -v can mislead. Ubuntu 24.04’s fixed package is 8.3.6-0ubuntu0.24.04.13. Digest-pinned images need a new digest. Changing Composer’s require.php patches nothing.
How do you install and run it?
In Devin, open Customize, then Plugins, then Browse Marketplace, and search for Vulnerability Fixes. The Devin CLI uses devin plugins install CognitionAI/devin-marketplace#plugins/devin-vuln-fixes. For other agents, run npx skills add CognitionAI/devin-vuln-fixes. Claude Code users can add the marketplace and run /plugin install vuln-fixes@cognition-skills.
Then ask in plain language, such as ‘Please fix my PHP vulnerability.’ Slash commands also work: /fix-php-vuln, /fix-node-vuln and /fix-gitlab-vuln.
How does it compare with Dependabot, Copilot Autofix and Snyk Agent Fix?
These tools solve adjacent problems. Dependabot and the code-fix agents work on application dependencies and source code. Cognition’s plugin targets the runtime layer: base images, OS packages and infrastructure-as-code.
Key Takeaways
- Three MIT-licensed skills patch PHP2Shell, Node.js and GitLab CVE-2026-110264.
- Read-only inventory and an approval gate come before any edit.
- Tests run before and after inside the new production image.
- Works across Devin, Claude Code, Codex, Cursor and other SKILL.md agents.
- No published fix-rate benchmark; results depend on your test coverage.
Check out the GitHub repo, the Cognition blog post and the plugin page. Also, feel free to follow us on Twitter and don’t forget to join our 150k+ML SubReddit and Subscribe to our Newsletter. Wait! are you on telegram? now you can join us on telegram as well.
Need to partner with us for promoting your GitHub Repo OR Hugging Face Page OR Product Release OR Webinar etc.? Connect with us
Michal Sutter is a data science professional with a Master of Science in Data Science from the University of Padova. With a solid foundation in statistical analysis, machine learning, and data engineering, Michal excels at transforming complex datasets into actionable insights.
Auto-fetched and translated by AI Atlas. All rights belong to the original author.