[← Devin for Security](https://devin.ai/security)

# Patch critical vulnerabilities with Devin

We’ve open sourced an agent plugin to help patch critical vulnerabilities. Use it in Devin or any agent to help secure your systems against urgent cybersecurity threats.

[Add the plugin](https://app.devin.ai/customize?tab=plugins\&details=https%3A%2F%2Fgithub.com%2FCognitionAI%2Fdevin-marketplace%23plugins%2Fdevin-vuln-fixes)

Free and open source. [View source](https://github.com/CognitionAI/devin-marketplace/tree/main/plugins/devin-vuln-fixes) · [Read the blog post](https://devin.ai/blog/vulnerability-fixes-plugin)

![](https://devin.ai/_next/image?url=%2Fassets%2Fimages%2Fsecurity%2Fvulnerability-fixes-hero.jpg\&w=3840\&q=75\&dpl=dpl_Dk9Y1cgi579KQjjgwN73WcY4UWb7)

Recent updates

[Once the plugin is added](https://app.devin.ai/customize?tab=plugins\&details=https%3A%2F%2Fgithub.com%2FCognitionAI%2Fdevin-marketplace%23plugins%2Fdevin-vuln-fixes), run any of these to patch the matching advisory across your repos.

October 21, 2026

### PHP

Critical · CVSS 9.2

CVE-2026-109618CVE-2026-109619

Two unauthenticated remote code execution flaws in every web-serving SAPI (mod\_php, PHP-FPM, php-cgi, FrankenPHP, LiteSpeed). PHP 8.1 and older are not covered by these releases.

AffectedAll PHP installations serving web requests

Fixed in8.5.12, 8.4.27, 8.3.36, 8.2.35

[Patch with Devin](https://app.devin.ai/?prompt=Use+the+fix-php-vuln+skill+from+the+Vulnerability+Fixes+plugin.+If+the+plugin+is+not+installed+already%2C+add+it.+Then+inventory+every+repo+connected+to+Devin+for+PHP+runtimes+affected+by+CVE-2026-109618+and+CVE-2026-109619%2C+show+me+the+table%2C+and+wait+for+my+approval+before+patching.)[php.net advisory](https://www.php.net/archive/2026.php#2026-10-21-5)[fix-php-vuln skill](https://github.com/CognitionAI/devin-marketplace/tree/main/plugins/devin-vuln-fixes/skills/fix-php-vuln/SKILL.md)

October 21, 2026

### Node.js

Critical · CVSS 9.2 · 10 CVEs fixed

CVE-2026-111497+ 9 more

Ten CVEs across Node 22, 24 and 26, led by a Brotli decoder out-of-bounds write that permits remote code execution. Node 20 and older are also exploitable but end-of-life, so there is no patch: they need a major upgrade to 22 or later.

AffectedNode.js 20 and older (no fix, end-of-life), and 22, 24 and 26 before the fixed releases

Fixed in26.12.1, 24.22.1, 22.23.4

[Patch with Devin](https://app.devin.ai/?prompt=Use+the+fix-node-vuln+skill+from+the+Vulnerability+Fixes+plugin.+If+the+plugin+is+not+installed+already%2C+add+it.+Then+inventory+every+repo+connected+to+Devin+for+Node.js+runtimes+affected+by+the+October+21%2C+2026+security+release+%28CVE-2026-111497%29%2C+show+me+the+table%2C+and+wait+for+my+approval+before+patching.)[nodejs.org advisory](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases)[fix-node-vuln skill](https://github.com/CognitionAI/devin-marketplace/tree/main/plugins/devin-vuln-fixes/skills/fix-node-vuln/SKILL.md)

October 21, 2026

### GitLab (self-managed)

Critical · CVSS 10.0

CVE-2026-110264

Unauthenticated remote code execution through an integer overflow in the regular expression compiler. Self-managed only; GitLab.com and GitLab Dedicated are already patched.

AffectedGitLab CE and EE, all versions from 7.0

Fixed in19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13

[Patch with Devin](https://app.devin.ai/?prompt=Use+the+fix-gitlab-vuln+skill+from+the+Vulnerability+Fixes+plugin.+If+the+plugin+is+not+installed+already%2C+add+it.+Then+inventory+every+repo+connected+to+Devin+for+self-managed+GitLab+instances+affected+by+CVE-2026-110264%2C+show+me+the+table%2C+and+wait+for+my+approval+before+patching.)[GitLab patch release](https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/)[fix-gitlab-vuln skill](https://github.com/CognitionAI/devin-marketplace/tree/main/plugins/devin-vuln-fixes/skills/fix-gitlab-vuln/SKILL.md)

Fireside chat

## Navigating the Security Dark Age

Cognition CSO Alex Stamos on remediating this week’s PHP and Node.js vulnerabilities, and what to change so the next ones are routine.

Monday, October 26 · 10:30 AM PT · 45 min · Online[Register](https://devin.ai/webinars/patching-critical-vulnerabilities)

Speaker

![Alex Stamos](https://devin.ai/_next/image?url=%2Fassets%2Fimages%2Fwebinars%2Falex-stamos.png\&w=256\&q=75\&dpl=dpl_Dk9Y1cgi579KQjjgwN73WcY4UWb7)

[Alex Stamos](https://en.wikipedia.org/wiki/Alex_Stamos)Chief Security Officer, CognitionFormer Chief Security Officer at Facebook and CSO at Yahoo; founding director of the Stanford Internet Observatory.

Customer proof

[![](https://devin.ai/assets/images/cloud/itau-logo.svg?dpl=dpl_Dk9Y1cgi579KQjjgwN73WcY4UWb7)Case study · Itaú Unibanco](https://devin.ai/customers/itau)

[\~70%](https://devin.ai/customers/itau)

[of vulnerabilities flagged by SonarQube, Fortify and Veracode remediated automatically by Devin in Itaú's CI/CD pipelines. Engineers review the patch.](https://devin.ai/customers/itau)

[Read the Itaú case study ↗](https://devin.ai/customers/itau)

[![Devin remediation PR for SonarQube findings](https://devin.ai/_next/image?url=%2Fassets%2Fimages%2Fcloud%2Fvulnerability-remediation.png\&w=3840\&q=75\&dpl=dpl_Dk9Y1cgi579KQjjgwN73WcY4UWb7)](https://devin.ai/customers/itau)

Talk to sales

## Get a Devin demo

Learn how Devin can help manage Node and PHP modernization projects. For enterprises working on these fixes, we are offering significant credits and support.

[Get a demo](https://devin.ai/demo)[Devin for Security](https://devin.ai/security)

## Frequently Asked Questions

What does the plugin do?

Inventory the affected repos, patch to the nearest verified fixed version, run your tests before and after, and open one PR per repo with a risk label and a rollout/rollback plan.

Does Devin change anything without approval?

No. The inventory is read-only; Devin stops and waits for you to pick which repos to patch.

Can I use the skills outside Devin?

Yes. The skills are plain Markdown (SKILL.md), usable by any agent.

Does the GitLab skill cover GitLab.com?

No, GitLab patched those. The skill covers self-managed: Omnibus, Docker, Helm, Operator and the IaC that deploys them.