Cognition launches open-source plugin to address critical cybersecurity vulnerabilities

Cognition has released an open-source plugin called Devin Vulnerability Fixes, designed to address three critical remote code execution vulnerabilities. These include PHP2Shell, a Node.js security update from October 21, 2026, and a CVSS 10.0 self-managed GitLab bug. The plugin is available on GitHub under the MIT license and can be used by any coding agent that reads SKILL.md files. Developers can perform inventory checks, approve patches, test, and submit pull requests through the plugin. The plugin includes five-step workflows for patching vulnerabilities, while also highlighting common pitfalls such as misleading version checks and the need for updated image digests. It is compatible with Devin, other coding agents, and platforms like Claude Code. Users can install the plugin via the Devin CLI or other agents, and use plain language commands like 'fix PHP vulnerability' or slash commands for specific fixes. The plugin targets runtime layers, including base images and OS packages, differing from tools like Dependabot that focus on application dependencies.