Cognition releases agent plugin to fix PHP and Node.js holes, including a CVSS 9.2 flaw

On October 21, 2026, urgent security updates shipped for PHP and Node.js, and both stories involve remote code execution. PHP fixed a pair of vulnerabilities called PHP2Shell (CVE-2026-109618 and CVE-2026-109619), rated CVSS v4 9.2, that require no authentication. Node.js fixed 10 CVEs, four of them rated High. Cognition, the company behind the Devin agent, says the flaws are already being exploited automatically. It has released an open-source plugin that turns a coding agent into the executor of the entire patching process.

What exactly is broken

PHP2Shell consists of two bugs. The first, CVE-2026-109618, is memory corruption after an out-of-memory condition. The second, CVE-2026-109619, is stale global state that one request leaves behind for the next. Any PHP web configuration is exposed: PHP-FPM, php-cgi, FrankenPHP, LiteSpeed and Apache mod_php, which carries the highest risk.

The main problem in Node.js is CVE-2026-111497, an out-of-bounds write in the Brotli decoder that can lead to code execution. Patch internet-facing services that decompress Brotli first: HTTP clients, servers and proxies. Three more High-severity vulnerabilities (CVE-2026-105482, CVE-2026-105483, CVE-2026-106069) involve TLS and hostname verification. They are dangerous for services that connect to user-supplied addresses.

• PHP: fixes are in 8.2.35, 8.3.36, 8.4.27 and 8.5.12; for 7.4, 8.0 and 8.1, only source backports have been published
• Node.js: 22.23.4, 24.22.1 and 26.12.1
• Node.js 20 and older are out of support: no patches will be issued, and the vulnerability remains; you need to move to 22+
• The Node.js release updates OpenSSL, c-ares, Undici, SQLite and the CA store, where the eMudhra root certificate has been removed

Why "just update" doesn't work

PHP and Node.js hide in container images, OS packages, CI pipelines, Helm values, Terraform and Lambda runtimes, often across dozens of repositories. Every deployment has to be found, updated, tested and rolled out.

There are traps. Debian and Ubuntu backport fixes without changing the upstream version: on Ubuntu 24.04 the fixed package is named 8.3.6-0ubuntu0.24.04.13, and `php -v` will still show 8.3.6. You have to check the vendor's security bulletin or the package changelog. Images pinned by digest need a new digest, and floating tags such as php:8.3-fpm must be rebuilt on a new base image. Editing require.php or config.platform.php in Composer fixes nothing: those settings do not select the runtime in production.

If you can't update right away, PHP suggests temporary mitigations. They include session.upload_progress.enabled=0 with a restart of all workers, and limits on request body size and the number of multipart parts at the proxy. You must not use RLIMIT_AS and RLIMIT_DATA: they trigger the vulnerable code path themselves.

How the plugin works

The Vulnerability Fixes plugin is built from the process Cognition used to fix its own infrastructure. First, the agent runs a read-only inventory: Dockerfiles, base images, packages, source builds, setup-php, setup-node, .nvmrc, Terraform, Packer, Ansible, Chef and Puppet. It then shows a table and waits for you to say which repositories it may touch. Anything riskier than a patch-version change (a minor or major upgrade, a base OS change, likely code edits) it flags up front.

Next, the agent checks tags, digests, package versions and checksums against official registries. It runs the tests on the current version as a baseline, repeats them in the new production image, and compares runtimes: extensions, ini settings, OpenSSL and ICU versions. The output is one PR per repository, with before-and-after versions, test results, a risk label, and a rollout and rollback plan.

The plugin is available in the Devin Marketplace and as standard Agent Skills for Claude Code, Codex, Cursor, Factory Droid, GitHub Copilot, Gemini CLI and OpenCode: `npx skills add CognitionAI/devin-vuln-fixes`. Skills run with your agent's full permissions, so Cognition asks you to read them before running. Building and testing require git, a shell, Docker and access to your image registry.

Where to start today

Cognition's first piece of advice is to take public-facing PHP applications offline while patching is under way, because exploitation is automated. After that:

• check versions against the distribution's bulletin, not `php -v`
• rebuild images that use floating tags and replace the digest on pinned ones
• put Node 20 and older into a migration plan to 22+
• roll out risky PRs to staging or canary first
• after merging, redeploy every service: the fix only takes effect in the new build

The agent only verifies what the tests cover, so for poorly tested applications the PR explicitly recommends staging. Managed runtimes are fixed by the provider, and for vendor hardware solutions and Electron apps with bundled PHP or Node, the agent only flags them for a vendor update.

Cognition believes such incidents will become the norm: vulnerabilities are being found faster, and attackers are using AI to automate exploitation chains. The company recommends continuously scanning your external attack surface, moving internal applications behind a VPN or ZTNA, moving to current runtimes and containers, and abandoning 30-day patching cycles. Security chief Alex Stamos will host a webinar on October 26 at 10:30 a.m. Pacific time.