Skip to content
Cognition Releases Devin Plugin to Patch Critical RCE Vulnerabilities

Cognition Releases Devin Plugin to Patch Critical RCE Vulnerabilities

First seen 25 Oct 2026, 06:11 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 25, 2026 at 07:13 UTC
  • •Cognition's Devin plugin targets three critical RCE vulnerabilities.
  • •GitLab CVE-2026-110264 has a CVSS score of 10.0, allowing unauthenticated code execution.
  • •The plugin is free, open-source, and supports multiple coding environments.

Cognition has launched the Devin Vulnerability Fixes plugin, targeting three critical remote code execution (RCE) vulnerabilities. The plugin addresses CVE-2026-109618 and CVE-2026-109619 in PHP, CVE-2026-111497 in Node.js, and CVE-2026-110264 in GitLab. These vulnerabilities affect various web-serving setups, including mod_php and GitLab self-managed instances, with a CVSS score of 10.0 for the GitLab bug. The plugin is free and open-source, designed to run on multiple coding agents. Users are advised to upgrade to the latest versions of PHP and Node.js for protection. The plugin facilitates a five-step remediation process, ensuring thorough testing before deployment. Current status indicates that GitLab.com and GitLab Dedicated have already been patched.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-21
CVE-2026-109618 and CVE-2026-109619 published
PHP vulnerabilities allowing RCE were disclosed, with CVSS scores of 9.2.
Marktechpost
2026-10-22
CVE-2026-111497 published
Node.js vulnerability leading to RCE was disclosed, rated CVSS 9.2.
Marktechpost
2026-10-22
CVE-2026-110264 published
GitLab vulnerability allowing unauthenticated RCE was disclosed, rated CVSS 10.0.
Marktechpost

More articles in this cluster (3)

Following this threat?

Track Cognition and CVE-2026-109618 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (14)

1 / 3

Common questions

Which systems are affected by these vulnerabilities?
The vulnerabilities affect PHP (mod_php, PHP-FPM), Node.js (versions 22, 24, 26), and self-managed GitLab instances.
What is the CVSS score for the GitLab vulnerability?
CVE-2026-110264 has a CVSS score of 10.0, indicating a critical severity level.
How can I use the Devin plugin?
The Devin plugin can be installed and run in any compatible coding agent to patch the identified vulnerabilities across your repositories.