Wednesday, November 4, 2026
News For Internet Marketers
Nacha's October 8 request for information on first-party fraud asks whether billers should be able to prove a disputed ACH debit was authorized, floats new entry descriptions and indicators, and proposes a recredit clarification for June 18, 2027. Responses are due December 11.
North Carolina's vapor products directory will list every product by SKU, update on the first of each month and flag removals, giving retailers 30 days to sell or return delisted stock before it can be seized. Police and state investigators now run the inspections.
Commerce.com and Cloudflare switched on WebMCP by default for eligible BigCommerce storefronts on October 21. Shopping tools reach browser agents only when Storefront MCP is on, and the opt-out applies to an entire storefront, with no product or category exclusions described.
WordPress 7.1.4, released October 28 with backports to 4.7, fixes an unauthenticated upgrade-window race that Wordfence says attackers began probing within hours, along with stored XSS bugs and a root certificate update tied to the eMudhra revocation.
The PHP project fixed the PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619 on October 21 only for PHP 8.2 through 8.5, leaving WooCommerce stores on PHP 8.1 or older dependent on host backports as CISA lists both flaws as exploited.
TeamUpdraft says attackers who reached teamupdraft.com on October 17 and 18 used UpdraftCentral connections to add administrator accounts and hidden plugins to WordPress sites, and that disconnecting a site does not remove what was installed.
USA Today's October 21 guide sends GLP-1 patients to state pharmacy license lookups, PCAB or CCE accreditation checks, and FDA's compounding actions list. An analysis of what telehealth sellers can disclose about the dispensing pharmacy to build trust and limit disputes.
Authorize.Net knowledge article 000001205, updated September 29, 2026, says AIM, SIM, DPM, Relay Response and Silent Post are being phased out and that merchant-defined fields may not carry card numbers or personal data such as names, contact details or dates of birth.
Since July 1, 2026, California's SB 378 has required online hemp marketplaces, including single-brand stores offering intoxicating hemp, to run a public report mechanism with 36-hour confirmations, 14-day updates, 30-day decisions, and $10,000 per-violation penalties enforceable by any person.
The Mississippi Board of Pharmacy's October 2026 newsletter says a certificate of analysis alone does not satisfy the state's joint peptide statement, that human-use disclaimers do not prevent enforcement, and that out-of-state telehealth prescribers need a Mississippi license.
