Friday, October 23, 2026
News For Internet Marketers
Sansec documented a Magecart skimmer that loads from real Google Tag Manager containers and stores Magento checkout data as fake Stripe customers. Why a CSP allowlist misses it, what PCI DSS 6.4.3 and 11.6.1 expect, and what to check.
NSSF told ATF in August that remote same-state gun sales would weaken dealers' role as a first line of defense. An analysis of what the May 8 proposal requires and what it would mean for online FFL checkouts.
Analysis. Stripe's Prohibited and Restricted Businesses page, updated September 22, 2026, says U.S. merchants selling electronic tobacco may only sell FDA-authorized products. Shopify Payments prohibits tobacco outright, and PayPal's 2022 policy puts e-cigarettes in pre-approval.
Shopify opened Shop MCP on October 13 so AI agents can search Shopify Catalog and check out with Shop Pay. Sellers of age-restricted and regulated products have reason to review how their listings, age checks, and order controls work when an agent does the buying.
BigCommerce lists native NMI and Authorize.Net connections for specialty MIDs when platform rails drop regulated catalogs. The Payments API table shows Authorize.net vaulting support and NMI raw-card-only limits, while Commerce's AUP puts highly regulated product compliance on the merchant.
NMI's Classic API Migration Playbook moves server-side payments from /api/transact.php to JSON endpoints such as POST /api/v5/payments/sale, with the private key alone in the Authorization header and errors returned as HTTP status codes. Keys and Collect.js tokens carry over, and the classic API stays supported.
WooCommerce 11.2 adds a date field type to the Additional Checkout Fields API, letting Checkout block stores collect a birth date and reject underage birthdays with relative limits such as -P21Y. The field is self-reported, so vape sellers still need PACT Act database verification.
Public Law 119-103 delays most of the federal hemp redefinition to December 11, 2026, but Missouri HB 2641 and Illinois Public Act 104-463 still take effect November 12, forcing earlier cart blocks and licensed-channel rules for intoxicating hemp SKUs.
WooCommerce 11.2.0, released October 7, 2026, fixes CVE-2026-106608, which let shop managers take over multi-role accounts including some administrators, and adds four other security changes. 11.2.1 followed on October 9 with checkout fixes.
Shopify opened market-driven shipping to existing merchants on October 1, 2026, with every store moved by July 1, 2027. The upgrade replaces shipping profiles, which some hemp, nicotine, knife, and tactical sellers use to keep restricted products out of certain states, and changes several defaults those blocks depended on.
