Devin Blog · Oct 25, 2026 · 3:20 AM

Cognition open-sources agent skills that patch this week's PHP, Node.js and GitLab RCEs

The MIT-licensed devin-vuln-fixes skills work in any agent that reads SKILL.md (Claude Code, Codex, Cursor and more): they inventory your repos read-only, wait for your approval, patch to a verified fixed version, run tests before and after inside the new image, and open one PR per repo. They cover PHP2Shell, the Oct 21 Node.js security release and the CVSS 10.0 self-managed GitLab bug CVE-2026-110264; install with npx skills add CognitionAI/devin-vuln-fixes.

Read at devin.ai

More news

View all

Qwen Code 0.26.1 can gate scheduled tasks on a shell check and adds /autofix-pr

Released Oct 24, a scheduled task can now wait on a shell command run outside the model, which powers new PR watch probes and an /autofix pr command that pushes fixes, syncs, replies and re runs checks. It also adds qwen daemon start save token to keep the daemon token in an owner only file and lets the Managed Agent swap MCP servers without recreating sessions…

GitHub (QwenLM/qwen-code) 30 minutes ago

Kiro CLI 2.34 lets MCP tools pause mid-call to ask you for missing input

Released Oct 23, MCP elicitation in local V3 sessions lets a tool show a form or link when it needs details, then carry on with the same call once you answer or decline, instead of failing and restarting. The release also lets you delete memories from /memories , adds more Workflow controls and a model picker editor, and improves headless MCP sign in…

Kiro Changelog 3 hours ago

LiteLLM's poisoned 1.107.0 traced to an unrevoked agent-platform key holding an owner's GitHub CLI token

In an Oct 23 post mortem, LiteLLM says a master key for its self hosted cloud agent platform leaked in a public repo on May 27 and was never revoked; on Oct 10 an attacker used it to pull the org owner's unscoped GitHub CLI token the agents used to open PRs, then stole two maintainers' tokens from CI secrets and ran the release pipeline against a lookalike Berri AI/litellm fork. If your agents file PRs, give them a scoped service account token rather than a person's gh login (Microsoft analysis)…

LiteLLM Blog 4 hours ago

AWS open-sources Infinity, a Rust agent runtime that fits 75,000 waiting agents on a Raspberry Pi

AWS and UC Berkeley's Hydro project released Infinity (Apache 2.0), which saves an agent's conversation and suspends it during each tool call, so idle agents cost about nothing and can run on serverless like Lambda. It's an early research release; existing MCP servers work through a compatibility layer…

AWS Open Source Blog 5 hours ago

goose 1.56.0 lets you resume failed subagents and cap how many run at once

Released Oct 23, goose can now resume delegate subagents that failed or were cancelled, links each subagent's view only session in the desktop UI, and limits parallel subagents with GOOSE MAX CONCURRENT SUBAGENTS . It also adds automatic thinking levels, a Windows NSIS installer, and swaps code mode's runtime for the Boa JavaScript engine…

GitHub (aaif-goose/goose) 6 hours ago

Spotted something we missed? Start a thread.