# Fixing Critical Node & PHP Flaws By Steven Van · 2026-10-22 The open-source Vulnerability Fixes plugin finds affected PHP and Node repos, tests before and after patching, and opens one pull request per repo. Devin has released Vulnerability Fixes, an open-source plugin for [Devin]() and other coding agents. It handles remediation of the security updates the PHP and Node.js projects [published on October 21, 2026](), which address vulnerabilities that can allow remote code execution. ## The vulnerabilities - **PHP2Shell (CVE-2026-109618, CVE-2026-109619):** two critical (CVSS v4 9.2) unauthenticated remote code execution flaws in the PHP runtime. PHP's advisories say every web-serving setup is at risk, including PHP-FPM, Apache mod\_php (rated highest risk), php-cgi, FrankenPHP and LiteSpeed. Fixed versions are 8.2.35, 8.3.36, 8.4.27 and 8.5.12. PHP 8.1 and older get no new releases, though PHP published source-level backports for 7.4, 8.0 and 8.1. - **Node.js October 2026 security release:** fixes 10 CVEs, four rated High. CVE-2026-111497 is an out-of-bounds write in the Brotli decoder that can lead to remote code execution. CVE-2026-105482, CVE-2026-105483 and CVE-2026-106069 are TLS and DNS hostname issues. Fixed versions are 22.23.4, 24.22.1 and 26.12.1. Node.js 20 and older are end-of-life, will not be fixed, and need a major upgrade to 22 or later. Devin notes that distro packages keep their old version numbers when fixes are backported, so *php -v* is not a reliable check. Images pinned by digest need a new digest, and floating tags need a rebuild. Changing Composer's *require.php* or *config.platform.php* does not patch anything. ## How the remediation works Devin says the vulnerabilities are being actively exploited by automated means, and advises taking PHP web applications down while patching. The plugin then works in steps: - **Inventory (read-only):** searches every accessible repository for PHP or Node in Dockerfiles, base images, distro packages, source builds, CI configuration, Helm values, Terraform, Packer, AWS Lambda runtimes, and Ansible, Chef or Puppet, then reports what is affected and what is already fixed. - **Approval:** the user chooses which repositories to patch. Devin flags anything riskier than a patch bump, such as a minor or major upgrade, a base-OS change or a likely application-code change. - **Verified target:** tags, digests, package versions and checksums are confirmed against the official registry, vendor advisory or php.net. - **Test before and after:** the test suite runs on the current version for a baseline, then again inside the new production image. Devin compares the runtimes, starts the container and checks real responses. If anything regresses, it stops and proposes the smallest fix. - **Pull requests:** one per repository, with before/after versions, test results, runtime differences, a risk label, and a rollout and rollback plan. ## Installing and running it In Devin, open Customize, then the Plugins tab, choose Browse Marketplace, search for Vulnerability Fixes and install it to the relevant scope. In the Devin CLI, run *devin plugins install CognitionAI/devin-marketplace#plugins/devin-vuln-fixes*. Organization or Enterprise admins can install it for many users. Start a session with "Fix PHP vulnerabilities", "Fix Node vulnerabilities" or "Fix GitLab vulnerabilities", ask in plain language, or run */vuln-fixes:fix-php-vuln*, */vuln-fixes:fix-node-vuln* or */vuln-fixes:fix-gitlab-vuln*. Naming repositories narrows the scope. After reviewing the inventory table, tell Devin which repositories to patch and whether major upgrades such as Node 20 to 22 are in scope. ## Limits The fix only takes effect once the new build is deployed, so patched services must be redeployed and floating-tag images rebuilt. Devin can only validate what existing tests cover. For lightly tested applications the pull request says so and recommends staging or a canary. Managed runtimes are patched by their provider, and Devin reports these with the check to run rather than claiming they are fixed. ![Devin]() Devin AI software engineering agent for building features, fixing bugs, reviewing code, and handling work across repositories. [View Devin →]() Sources [Original source]() [Read Fixing Critical Node & PHP Flaws on Creators Toolbox]() --- Canonical source: https://creatorstoolbox.com/blog/devin-fixing-critical-node-and-php-flaws