What happened
On Oct 22, 2026 Cognition published the Devin Vulnerability Fixes plugin (MIT, three Agent Skills) that automates remediation of PHP2Shell (CVE-2026-109618/109619), the Node.js Oct 21 release, and GitLab CVE-2026-110264 (CVSS 10.0). The plugin does read-only inventory across Dockerfiles, base images, OS packages, CI, Helm, Terraform and IaC, gates edits behind user approval, verifies tags/digests/checksums against official sources, tests before and after inside the new production image, and opens one PR per repo.
Why it matters
It packages the remediation workflow into a reusable, cross-agent (Devin, Claude Code, Codex, Cursor, Gemini CLI) OSS release targeting live, actively-exploited RCEs at the runtime/infra layer that dependency-only tools (Dependabot, Snyk) don't cover. It's a concrete example of agentic security automation being productized for the week's highest-severity disclosures.
Applicability
Security and platform engineering teams running PHP, Node.js or self-managed GitLab should use the plugin (or replicate its inventory-test-approve-PR flow) to close these CVEs; validation quality still depends on existing test coverage, so treat generated PRs as a starting point to review.