On October 23, 2026 (Beijing time 17:03), Qoder’s official account @qoder_ai_ide posted that PHP and Node.js both shipped critical security updates on October 21, and that you can install php2shell Defense or Node.js Vulnerability Scan in Qoder. Per that post, Qoder then checks your project for impact, pinpoints what to change, and drafts a fix—and nothing changes until you approve.
The announcement names two Skills, ties them to the October 21 runtime security updates, and keeps an approve-before-apply gate on code changes. Qoder’s Skills docs describe the general install path—Extensions → Skills, open details, Install—and say you can type `/` in a task to pick an installed Skill. They also note that installing a Skill does not remove the normal access controls for a task, and that you should review permission requests during execution. There are no dedicated public pages for these two Skills yet; install and use them following the general Qoder Skills docs.
Related reading: How Qoder Takes Tasks from WeCom After You Set Up the Plugin and Best Coding Agents Right Now, Ranked by Artificial Analysis (October 2026). For website-owner context on AI-assisted PHP flaw hunting, see AI Helped Find Critical PHP Flaws. Here’s What Website Owners Should Check.
For installing these two Skills and running the scan-and-fix flow on a real project, we have not tested them yet; if you have, you can send feedback through the site contact link in the footer.