Thursday, November 5, 2026
News For Internet Marketers
WooCommerce 11.3, scheduled for the week of November 9, 2026, adds payment method as a column, CSV field and filter in Analytics Orders, backfills older orders in the background, and tightens validation on refunds created through the REST API.
Shopify's October 27 security update sets the enforcement path for public apps that still use non-expiring offline access tokens, with App Store delisting on January 1, 2027, merchant warnings on January 15 and HTTP 403 errors from April 1.
FDA on October 19, 2026 finalized the identity, history of use and safety summary sections of its 2016 new dietary ingredient draft, replacing two safety profiles with one safety narrative and keeping 25 years of widespread use as the usual floor for history alone.
Nacha's October 8 request for information on first-party fraud asks whether billers should be able to prove a disputed ACH debit was authorized, floats new entry descriptions and indicators, and proposes a recredit clarification for June 18, 2027. Responses are due December 11.
TeamUpdraft says attackers who reached teamupdraft.com on October 17 and 18 used UpdraftCentral connections to add administrator accounts and hidden plugins to WordPress sites, and that disconnecting a site does not remove what was installed.
North Carolina's vapor products directory will list every product by SKU, update on the first of each month and flag removals, giving retailers 30 days to sell or return delisted stock before it can be seized. Police and state investigators now run the inspections.
Commerce.com and Cloudflare switched on WebMCP by default for eligible BigCommerce storefronts on October 21. Shopping tools reach browser agents only when Storefront MCP is on, and the opt-out applies to an entire storefront, with no product or category exclusions described.
WordPress 7.1.4, released October 28 with backports to 4.7, fixes an unauthenticated upgrade-window race that Wordfence says attackers began probing within hours, along with stored XSS bugs and a root certificate update tied to the eMudhra revocation.
The PHP project fixed the PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619 on October 21 only for PHP 8.2 through 8.5, leaving WooCommerce stores on PHP 8.1 or older dependent on host backports as CISA lists both flaws as exploited.
Authorize.Net knowledge article 000001205, updated September 29, 2026, says AIM, SIM, DPM, Relay Response and Silent Post are being phased out and that merchant-defined fields may not carry card numbers or personal data such as names, contact details or dates of birth.
