Cognition open-sources Devin vulnerability fixes plugin covering PHP and Node flaws
Cognition open-sourced Devin's vulnerability fixes plugin, installable in Claude Code and Codex, which automatically applies fixes for PHP2Shell and several high-severity Node.js flaws per official advisories, published on GitHub under the MIT license.
Cognition open-sourced Devin's vulnerability fixes plugin on October 22. PHP and Node ecosystems had published multiple security updates on October 21, including the widely discussed PHP2Shell remote code execution flaw tracked as CVE-2026-109618 and CVE-2026-109619, alongside about ten critical Node.js vulnerabilities.
The plugin installs directly in Claude Code and Codex. It reads official security advisories and generates matching patch code for user review before applying, a more traceable path than letting an agent discover vulnerabilities on its own since it does not depend on the model guessing vulnerability details.
The code is published on GitHub under the MIT license. Cognition did not state compatibility with tools beyond Claude Code and Codex.