Friday, October 9, 2026
News For Internet Marketers
Shopify opened market-driven shipping to existing merchants on October 1, 2026, with every store moved by July 1, 2027. The upgrade replaces shipping profiles, which some hemp, nicotine, knife, and tactical sellers use to keep restricted products out of certain states, and changes several defaults those blocks depended on.
Gambit Security's September 22 interim report says an operator using open-source AI agents built a target list of custom-coded online stores, took more than 600,000 card records from two companies, and hid skimmer loaders in library files, Google tag blocks, and, at a U.S. firearms marketplace, product description fields.
Restricted sellers shut out of Shopify Payments pay a plan-based surcharge on every gateway order, including tax and shipping, with no refund on returns. This analysis models the plan crossovers, the ENDS removal, and when self-hosting pays back.
Platform payment bans and Shop-channel limits push many firearms accessory merchants off Shopify Payments. This analysis weighs WooCommerce and BigCommerce for SKU control, age gates, and specialty gateway integrations before peak season.
Developers building firearm checkouts outside template apps often drop transfer-fee transparency and FFL handoff steps. Those gaps drive chargebacks and compliance failures when the buyer reaches the transferring dealer.
After Square's October 15 CBD catalog deadline and November 5 hemp-primary closure pattern, Shopify and WooCommerce stores need underwriting, dual-MID, plugin, ACH, and chargeback criteria before they trust any specialty gateway marketing page.
After active exploitation of WooCommerce Wholesale Lead Capture CVE-2026-27540, high-risk stores need file integrity monitoring on uploads, checkout templates, and admin users before acquirers ask for forensics.
As of Admin API 2026-10, updating a shipping address on an unfulfilled Shopify order recalculates destination taxes. Restricted-catalog operators that edit addresses in ops tools must re-read tax lines and balances.
Authorize.Net Account Updater in the New Merchant Interface (2.0) refreshes Visa and Mastercard cards on ARB and CIM profiles. Misread ACL and CCH responses can suspend subscriptions and spike retries that look like card testing.
Federal hemp deadlines do not erase stricter state milligram caps. Virginia's 2 mg per-package rule and Minnesota's 5 mg per-serving LPHE limits show why zip-to-SKU cart matrices need versioning.
