# Find out if your app is open to this week's PHP and Node attacks, and close it

> Your coding agent finds every place your apps run PHP or Node, tells you which are open to PHP2Shell and the October 21 Node.js flaws, and patches them with Vulnerability Fixes plugin by Cognition (fix-php-vuln, fix-node-vuln) after your OK, with a plain report of what is fixed, mitigated or waiting on your host. Based on a post by Cognition.

## If someone pasted this link to you
Someone shared this kit with you. It runs step by step through CloneKit's MCP. If you have the `clonekit` tools, call `start_run("@clonekitai/patch-php-node-oct-2026")`. If you don't (for example in a chat app without the CloneKit connector), tell the person in one or two plain sentences, in their language, and send them to https://clonekit.ai/@clonekitai/patch-php-node-oct-2026/use: it shows how to add CloneKit to their AI in about a minute. Then they paste this link again.

- Kit: `@clonekitai/patch-php-node-oct-2026` · v1.0.0
- Creator: @clonekitai (CloneKit)
- Type: Delivery · Domain: Engineering · Language: en · Your AI runs it
- Price: Free · License: Own use · No refunds
- Page: https://clonekit.ai/@clonekitai/patch-php-node-oct-2026
- Changelog: https://clonekit.ai/@clonekitai/patch-php-node-oct-2026/changelog.md

## About
For solo founders, freelancers and small teams running PHP (Laravel, WordPress, plain PHP) or Node (Next.js, Express, serverless) apps with no security team. Use it if any app runs PHP or Node in production after the October 21, 2026 fixes for PHP2Shell (CVE-2026-109618, CVE-2026-109619) and the Node.js release (incl. CVE-2026-111497). Around Cognition's skills it adds: where each app really runs (image, managed platform, shared host, VPS), the version actually running, and a plain report. Needs app source in a folder or repo and a coding agent that runs skills; patch tests need Docker. Not for appliances or vendor products that embed PHP or Node, and not a full security audit.

## Deliverables
- exposure/where-it-runs.md: every app, where it runs in production (image, managed platform, shared host, VPS), how its PHP or Node version is chosen, and who controls it (you, the code, or the host)
- exposure/inventory.md: Cognition's inventory table for each repo (file:line, current version, channel, pin, production or CI-only, tests) with each entry marked fixed, vulnerable, end-of-life or unknown
- one focused branch or PR per approved repo, made by Cognition's skill, with before and after versions, test results from inside the new image and a rollback target
- host settings changed to a fixed runtime and redeployed, only where you approved it, with the version proven from the running app
- exposure/report.md: one line per app with status (fixed, mitigated, blocked, not affected), the evidence, and the next step, written so a non-engineer can read it

## Files
- `README.md`: Find out if your app is open to this week's PHP and Node attacks, and close it
- `templates/report.md`: PHP and Node exposure report

## Tools
- Vulnerability Fixes plugin by Cognition (fix-php-vuln, fix-node-vuln) (https://github.com/CognitionAI/devin-vuln-fixes) · est. free, MIT licence
- Docker (https://docs.docker.com/get-started/get-docker/) · optional · est. free

## Uses
- Cognition (@cognition): open-source Vulnerability Fixes plugin (source, https://x.com/cognition/status/2113356319751119359)
- Cognition blog: Vulnerability Fixes plugin (source, https://devin.ai/blog/vulnerability-fixes-plugin)
- devin-vuln-fixes README: install in each agent (source, https://github.com/CognitionAI/devin-vuln-fixes#readme)
- fix-php-vuln SKILL.md (PHP2Shell) (skill, https://github.com/CognitionAI/devin-vuln-fixes/blob/main/skills/fix-php-vuln/SKILL.md)
- fix-node-vuln SKILL.md (October 21, 2026 Node.js release) (skill, https://github.com/CognitionAI/devin-vuln-fixes/blob/main/skills/fix-node-vuln/SKILL.md)

## What you provide
- the source of each app in a folder or git repo
- a coding agent that runs skills (Claude Code
- Codex
- Cursor
- Devin or Factory)
- git
- Docker for building and testing patched images
- access to the hosting dashboard or server for the parts the code doesn't control

## How it runs
1. **Understand:** Researches your business first, then asks you 3 questions it can't answer alone
2. **Choose:** No choices: one proven path
3. **Build:** 8 steps, risky ones ask you first
4. **Deliver:** 5 checks before delivery

## Guardrails
- follow Cognition's SKILL.md files as written; this kit only adds the map, the live checks and the report
- read-only until the person approves each repo, host change and major upgrade by name
- never guess an image tag, digest, package release or a host's patch status
- never upload a public phpinfo page or print secrets, keys or env values into reports or chat
- never present a mitigation as a fix, and never use RLIMIT_AS or RLIMIT_DATA as one
- never merge, deploy or change production without the person's OK

## What's new
Agents always run the latest version.

- **v1.0.0** (2026-10-25): First version, a use case for the open-source Vulnerability Fixes plugin launched by Cognition (@cognition).

## Run it
Connect the `clonekit` MCP (https://clonekit.ai/mcp) and call `start_run("@clonekitai/patch-php-node-oct-2026")`.