Attackers are actively targeting security holes in the Brotli decoder, Adobe Commerce and Magento, according to reporting from heise online published on 28 October 2026. The German tech outlet's coverage links the campaigns to a set of flaws that security researchers say affect more applications than first assumed.
The Brotli issue has drawn particular attention. According to t3n, the decoder vulnerability reaches more apps than initially believed, while Golem reports that it could allow malicious code attacks and puts numerous applications at risk. Brotli is a compression algorithm used widely in web traffic and software.
One confirmed fix concerns Node.js. it-daily.net reports that the JavaScript runtime has closed the Brotli decoder gap, and the Linux-Magazin carries a DFN-CERT advisory (2026-5917) describing multiple Node.js vulnerabilities that could, among other things, let attackers bypass security protections. That advisory indicates patching has begun on at least one affected platform.
The material does not specify how the Adobe Commerce and Magento flaws are being exploited, nor which versions are affected, so those details remain unclear from the available reporting.
What to watch next: whether Adobe issues guidance or patches for Commerce and Magento, and whether further software projects confirm Brotli decoder fixes. Administrators running Node.js should check for the updated release.
