Fixing Critical Node & PHP Flaws

Devin released Vulnerability Fixes, an open-source plugin for Devin and other coding agents, to help patch the PHP and Node.js vulnerabilities addressed in the October 21, 2026 security updates. Those vulnerabilities can allow remote code execution.

The plugin inventories affected repositories without changing them, then asks which ones to patch. It verifies target versions, runs tests before and after, and opens one pull request per repository. Changes riskier than a patch bump are flagged for review.

The fixes take effect only after deployment. Validation is limited by your existing tests; lightly tested applications get a recommendation for staging or a canary. For managed runtimes, the plugin reports the provider's patch check rather than claiming to have fixed them.