Monday's brief is busy. Anthropic filed its S-1 this morning, with $16.3 billion in first-half revenue per TechCrunch, but the four stories below are the ones with a command or a sign-up button attached. Start with the first if you run PHP or Node anywhere.
No sponsored or affiliate links in this digest — the links below are sources only.
Story I
Cognition's Devin Vulnerability Fixes plugin: three MIT skills that patch PHP2Shell, the Node.js Brotli RCE and GitLab's CVSS 10.0 bug
Cognition packaged the remediation workflow it used internally into three Agent Skills: fix-php-vuln, fix-node-vuln and fix-gitlab-vuln. Each runs a read-only inventory, stops at an approval gate, verifies target versions against the official source, tests before and after inside the new image, then opens one PR per repo. They cover PHP2Shell (CVSS 9.2, fixed in 8.2.35, 8.3.36, 8.4.27 and 8.5.12), the Node.js October 21 release and GitLab CVE-2026-110264, and run in Claude Code, Codex, Cursor and anything that reads SKILL.md. No fix-rate benchmark is published yet.
Link: github.com/CognitionAI/devin-vuln-fixes
Try it now
Any agent: npx skills add CognitionAI/devin-vuln-fixes (needs Node 22.20+, git and Docker). Claude Code: /plugin marketplace add CognitionAI/devin-vuln-fixes then /plugin install vuln-fixes@cognition-skills. Run /fix-php-vuln or ask "fix my PHP vulnerability" and approve the inventory before it touches anything. One trap from the README: Debian and Ubuntu backport fixes without bumping the version, so php -v can lie. Check the package changelog.
Story II
Microsoft's Agensh runs up to 1,024 coding agents with no orchestrator, and lifted pandoc from 56% to 80% with 32 agents
Microsoft Research open-sourced Agensh under MIT. Every worker runs the same five-step loop from the same prompt: gather context, claim a sub-task, act, verify, merge. Coordination runs through a Gitea repo, a Mattermost channel and a shared findings board, so no lead agent assigns anything. On the five hardest ProgramBench tasks with GPT-5.6-sol, the mean pass rate went from 19.31% with one agent to 28.78% with 128. Pandoc reached 55.06% at 1,024 agents, and the README adds 79.59% with 32 agents on GPT-6.1-sol, up from 56.19% solo. The runs used Copilot CLI. Token cost is not disclosed.
Link: github.com/microsoft/Agensh
Try it now
git clone https://github.com/microsoft/Agensh && cd Agensh, then read REPRODUCE.md. The single-node Docker Compose team defaults to 8 workers and 6 hours per task on Linux with Docker Compose v2, cgroup v2 and Python 3.11+. Launch with scripts/launch_single_node.sh, or run scripts/launch_single_agent.py first for a baseline. You need a model API token and ProgramBench v1.2.5 to reproduce the paper's numbers.
Story III
Nanbeige4.3-33B is a dense Apache 2.0 coding model with 512K context that reports 80.9 on Terminal-Bench 2.1
Nanbeige LLM Lab, the AI group inside Chinese recruiting platform BOSS Zhipin, put Nanbeige4.3-33B and a Base checkpoint on Hugging Face. It is 33B dense, text only, with a 524,288-token window and thinking plus tool calling built into the chat template. In the lab's own table it leads 17 of 20 rows against Qwen3.8-27B, Muse-Glimmer-30B and Gemma4-31B: 80.9 on Terminal-Bench 2.1 versus 73.0 for Qwen, 65.5 on DeepSWE versus 42.5, but 60.3 to Qwen's 61.7 on SWE-Bench Pro. MarkTechPost found two competitor numbers that look swapped against Meta's own card, so treat the table as provisional.
Link: huggingface.co/Nanbeige/Nanbeige4.3-33B
Try it now
You need multi-GPU for BF16 (about 66 GB of weights by MarkTechPost's arithmetic). The card's recipe: vllm serve /path/to/Nanbeige4.3-33B --tensor-parallel-size 4 --gpu-memory-utilization 0.8 --enable-auto-tool-choice --reasoning-parser qwen3 --tool-call-parser qwen3_coder. For agent work the lab recommends temperature 1.0, top_p 0.95 and 65,536 max new tokens. No Hugging Face inference provider hosted it at publication, so there is no API to poke yet.
Story IV
Ex-GitHub CEO Thomas Dohmke's Entire launched a GitHub alternative, with Trails replacing the pull request
Entire launched its Git-compatible hosting plus Trails on Monday, two days before GitHub Universe. A Trail runs agent-scored evals on every push, such as the risk of a change or intent drift across a long agent session, and shows them in a dashboard and an open-source CLI. The request, the agent's session history and the code all become part of the review; if the evals are green, Dohmke's pitch is that you merge without a line-by-line read. Review agents can be Claude or OpenAI models configured in JSON. Private repos only at launch. The platform is free; you pay for review-agent tokens after a $100 starter credit.
Link: entire.com
Try it now
Go to entire.com and hit Get Started (it lands on a login page; the site does not say whether access is gated). Pick a primary region, import one private repo, and push a small agent-made change to see a Trail score it. If you use GitHub Actions, Entire says you can convert workflows with Buildkite's bk pipeline tool or Depot CI before connecting the repo. Watch the token meter: after the $100 credit you pay market rates for whichever model reviews.
— The Vibe Gate news desk. We read the firehose so you can keep building.