Cognition拥有"Devin Voblicity Fixes"插件发布，是一套免费的开源系列agent技能。 它针对三个关键的远程代码执行(RCE)建议。 它们覆盖了PHP2Shell,"节点"(Node.js October 21, 2026)安全发布和一款CVSS 10.0自行管理的GitLabbug. 在德文和任何读取 SKILL.md 文件的编码agent中运行的技能。 Cognition对其内部使用的补救工作流程进行了包装。 开发者可以进行库存，批准，补丁，测试，然后每个寄存器进行1拉请求。
TL; DR 数据
- 大小：三种技能(fix-php-vuln,fix-node-vuln,fix-gitlab-vuln),MIT许可证。
- 运行于：德文，Claude Code,Codex,Cursor，工厂机器人，GitHub Copilot,Gemini CLI,OpenCode和Windsurf. 需要 git, a shell, Docker 和注册访问。 npx技能安装需要Node.js 22.20或更晚。
- 性能：该插件没有公布基准测试或固定速率编号。
- 最佳：覆盖了本周最严重的bug,GitLab CVE-2026-110264，被评为CVSS 10.0.
-最糟糕的是验证的强度只有测试的强度所管理的运行时间，电器和Electron应用程序被标出标记，而不是被补丁。
什么是 Devin 脆弱性修复插件？
Devin Culture Fixes插件是一套由Cognition出品的三款Agent技能。 他们发现并补齐了脆弱的PHP,Node.js和自管的GitLab部署。 来源于麻省理工学院许可下的GitHub. Cognition的产品页将其列为免费和开源。
它能解决哪些弱点？
- PHP2Shell(CVE-2026-109618,CVE-2026-109619):PHP的评分率都是CVSS v 4.0 9.2. 第一种在记忆外状态后会腐蚀记忆。 第二个是让全球国家从一个请求到下一个请求。 PHP 称每个网络服务设置都处于危险中，被mod php评为风险最高。 固定版本为8.2.35,8.3.36,8.4.27和8.5.12. PHP 8.1及更年长者得到的不是发布，只有7.4,8.0和8.1的源回口。
- Node.js 2026年10月发布：它修补了10个CVE,4个被评为"高". 铅虫CVE-2026-111497是一款能使RCE被启用的Brotli解码器出界书写。 固定版本为22.23.4,24.22.1和26.12.1. 20及更年长的节点js为报废而无固定。
- GitLab CVE-2026-110264：正则表达式编译器中的整数溢出允许未经认证的代码执行。 它从7.0起影响GitLab CE/EE，并得分CVSS 10.0. GitLab.com和GitLab 专用已补齐。
插件是如何工作的？
每种技能都遵循相同的五步形状：
- 仅读目录：agent扫描多克文件、底片图像、Distro包、CI、Helm、Terraform、Packer、Lambda和配置管理。
- 批准门：除非你重新选取，否则没有什么变化。 更危险的小或重大升级首先被叫出。
- 验证目标：编辑前，每个标签、文摘、软件包版本和检查和与官方来源核对。
- 前后试验：该套房运行在目前的版本上，然后在新的出品画面内。 后退止于跑道。
- 每回1个PR：每个PR携带版本，测试结果，运行时间diffs，一个风险标签和一个回滚计划。
这些技能还编码了已知的补丁陷阱。 Debian和Ubuntu的后端口不改变上游版本而修正，因此php-v可以误导。 Ubuntu 24.04的固定包件为8.3.6-0ubuntu0.24.04.13. 以文摘为主的图像需要新的文摘。 更改作曲家的要求.php 没有任何补丁。
你怎么安装和运行它？
在 Devin 中，打开自定义，然后是插件，然后浏览 Marketplace，并搜索易感的 Fixes。 Devin CLI使用devin插件安装了 CognitionAI/devin-marketplace#plugins/devin-vuln-fixes. 对于其他agents，运行npx技能会加入CognitionAI/devin-vuln-fixes. Claude Code用户可以添加市场并运行/plugin安装vuln-fixes@cognition-技能。
然后用简单的语言问，比如“请解决我的PHP弱点。” 斜线命令也工作：/fix-php-vuln,/fix-node-vuln和/fix-gitlab-vuln.
如何与Depabot,Copilot Autofix和Snyk Agent Fix进行比较？
这些工具解决相邻的问题。 Dependabot和代码-fix agents在应用程序依赖性和源代码方面的工作。 兹克 1Z的插件针对运行时层：基础图像，OS包和基础设施-as-code.
关键外卖
- 三个麻省理工学院许可技能补丁PHP2Shell,Node.js和GitLab CVE-2026-110264。
- 任何编辑之前，只读库存和批准大门。
- 测试在新的生产图像内前后进行。
- 工程跨越德文，Claude Code,Codex,Cursor等SKILL.md agents.
- 没有公布的固定率基准测试；结果取决于你的测试范围。
请检查access-date=中的日期值 (帮助) GitHub repo, Cognition博客帖和插件页面。 并加入我们的通讯。 等等，你在电报里吗？现在你也可以加入我们的电报。
需要和我们合作推广您的 GitHub Repo OR Hugging Face Page OR Product Release OR Webinar等吗？联系我们
米哈尔·萨特(Michal Sutter)是一名数据科学专业人员，拥有帕多瓦大学的数据科学硕士。 在统计分析、机器学习和数据工程的坚实基础上，Michal出色地将复杂的数据集转化为可操作的见解。
本文由 AI宝库自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
Cognition has released the Devin Vulnerability Fixes plugin, a free, open-source set of agent skills. It targets three critical remote code execution (RCE) advisories. They cover PHP2Shell, the Node.js October 21, 2026 security release and a CVSS 10.0 self-managed GitLab bug. The skills run in Devin and in any coding agent that reads SKILL.md files. Cognition packaged the remediation workflow it used internally. Developers can do inventory, approve, patch, test, then ship 1 pull request per repository.
TL;DR
- Size: Three skills (fix-php-vuln, fix-node-vuln, fix-gitlab-vuln), MIT license.
- Runs on: Devin, Claude Code, Codex, Cursor, Factory Droid, GitHub Copilot, Gemini CLI, OpenCode and Windsurf. Needs git, a shell, Docker and registry access. The npx skills install needs Node.js 22.20 or later.
- Performance: No remediation benchmark or fix-rate number is published for the plugin.
- Best: Covers the week’s most severe bug, GitLab CVE-2026-110264, rated CVSS 10.0.
- Worst: Validation is only as strong as your tests. Managed runtimes, appliances and Electron apps are flagged, not patched.
What is the Devin Vulnerability Fixes plugin?
The Devin Vulnerability Fixes plugin is a set of three Agent Skills from Cognition. They find and patch vulnerable PHP, Node.js and self-managed GitLab deployments. The source is on GitHub under the MIT license. Cognition’s product page lists it as free and open source.
Which vulnerabilities does it fix?
- PHP2Shell (CVE-2026-109618, CVE-2026-109619): PHP rates both flaws CVSS v4.0 9.2. The first corrupts memory after an out-of-memory condition. The second lets stale global state from one request reach the next. PHP says every web-serving setup is at risk, with mod_php rated highest risk. Fixed versions are 8.2.35, 8.3.36, 8.4.27 and 8.5.12. PHP 8.1 and older get no releases, only source backports for 7.4, 8.0 and 8.1.
- Node.js October 2026 release: It fixes 10 CVEs, 4 rated High. The lead bug, CVE-2026-111497, is a Brotli decoder out-of-bounds write that can enable RCE. Fixed versions are 22.23.4, 24.22.1 and 26.12.1. Node.js 20 and older are end-of-life and get no fix.
- GitLab CVE-2026-110264: An integer overflow in the regular expression compiler allows unauthenticated code execution. It affects GitLab CE/EE from 7.0 onward and scores CVSS 10.0. GitLab.com and GitLab Dedicated are already patched.
How does the plugin work?
Every skill follows the same five-step shape:
- Read-only inventory: The agent scans Dockerfiles, base images, distro packages, CI, Helm, Terraform, Packer, Lambda and config management.
- Approval gate: Nothing changes until you pick repos. Riskier minor or major upgrades are called out first.
- Verified target: Every tag, digest, package version and checksum is confirmed against the official source before editing.
- Test before and after: The suite runs on the current version, then inside the new production image. Regressions stop the run.
- One PR per repo: Each PR carries versions, test results, runtime diffs, a risk label and a rollback plan.
The skills also encode known patching traps. Debian and Ubuntu backport fixes without changing upstream versions, so php -v can mislead. Ubuntu 24.04’s fixed package is 8.3.6-0ubuntu0.24.04.13. Digest-pinned images need a new digest. Changing Composer’s require.php patches nothing.
How do you install and run it?
In Devin, open Customize, then Plugins, then Browse Marketplace, and search for Vulnerability Fixes. The Devin CLI uses devin plugins install CognitionAI/devin-marketplace#plugins/devin-vuln-fixes. For other agents, run npx skills add CognitionAI/devin-vuln-fixes. Claude Code users can add the marketplace and run /plugin install vuln-fixes@cognition-skills.
Then ask in plain language, such as ‘Please fix my PHP vulnerability.’ Slash commands also work: /fix-php-vuln, /fix-node-vuln and /fix-gitlab-vuln.
How does it compare with Dependabot, Copilot Autofix and Snyk Agent Fix?
These tools solve adjacent problems. Dependabot and the code-fix agents work on application dependencies and source code. Cognition’s plugin targets the runtime layer: base images, OS packages and infrastructure-as-code.
Key Takeaways
- Three MIT-licensed skills patch PHP2Shell, Node.js and GitLab CVE-2026-110264.
- Read-only inventory and an approval gate come before any edit.
- Tests run before and after inside the new production image.
- Works across Devin, Claude Code, Codex, Cursor and other SKILL.md agents.
- No published fix-rate benchmark; results depend on your test coverage.
Check out the GitHub repo, the Cognition blog post and the plugin page. Also, feel free to follow us on Twitter and don’t forget to join our 150k+ML SubReddit and Subscribe to our Newsletter. Wait! are you on telegram? now you can join us on telegram as well.
Need to partner with us for promoting your GitHub Repo OR Hugging Face Page OR Product Release OR Webinar etc.? Connect with us
Michal Sutter is a data science professional with a Master of Science in Data Science from the University of Padova. With a solid foundation in statistical analysis, machine learning, and data engineering, Michal excels at transforming complex datasets into actionable insights.
Auto-fetched and translated by AI Gem Box. All rights belong to the original author.