Tuesday, October 13, 2026
News For Internet Marketers
ATF's October 9, 2026 Open Letter ends enforcement of NFA approval and registration for suppressors, short-barreled rifles and shotguns, and any other weapons, but special occupational taxes, Gun Control Act duties, and state laws still govern online FFL sales.
WooCommerce 11.2.0, released October 7, 2026, fixes CVE-2026-106608, which let shop managers take over multi-role accounts including some administrators, and adds four other security changes. 11.2.1 followed on October 9 with checkout fixes.
Acquirers in California, Colorado, and New York must assign MCC 5723 to qualifying gun retailers, while Texas, Florida, Kentucky, Arkansas, and other states ban or restrict the code. The House passed H.R. 1181 on July 14, 2026 to preempt both sides, but the Senate has not acted.
DEA's final rule creating a special registration for telemedicine has been under OMB review since August 25, 2026, with a November target and no public text, while the temporary flexibilities that let practitioners prescribe Schedule II through V drugs to never-seen patients expire at the end of December 31.
DEA filed a notice on October 9 that would schedule 7-OH and mitragynine pseudoindoxyl above 1 milligram per gram or a set ratio to mitragynine, replacing its July 0.050 percent proposal, while MGM-15 and MGM-16 stay in Schedule I and Tennessee, Massachusetts, Rhode Island, and Pennsylvania draw different state lines for kratom sellers.
FDA's August 24, 2026 warning letters to Peak Performance Peptides, Royal Peptides, NuScience Peptides, Peptide Partners, and Tex Peptides set aside research use only disclaimers and list the product pages, study summaries, blog posts, calculators, and bacteriostatic water that FDA treated as evidence of intended human use.
Stripe, Checkout.com, and Worldpay documentation puts Mastercard's requirement that recurring and other merchant-initiated charges carry the original Transaction Link Identifier on October 23, 2026. The December 1, 2026 and January 31, 2027 dates now circulating match Worldpay's schedule for lifecycle linking, and Authorize.Net and NMI have not published TLID guidance.
Shopify opened market-driven shipping to existing merchants on October 1, 2026, with every store moved by July 1, 2027. The upgrade replaces shipping profiles, which some hemp, nicotine, knife, and tactical sellers use to keep restricted products out of certain states, and changes several defaults those blocks depended on.
Gambit Security's September 22 interim report says an operator using open-source AI agents built a target list of custom-coded online stores, took more than 600,000 card records from two companies, and hid skimmer loaders in library files, Google tag blocks, and, at a U.S. firearms marketplace, product description fields.
Eli Lilly's six retatrutide lawsuits came with a call for card companies and processors to cut off sellers, and a CBS News investigation then found more than 80 businesses promoting the unapproved drug under LegitScript's seal, raising the bar for licensed telehealth and compounding merchants in underwriting.
