Friday, October 30, 2026
News For Internet Marketers
PCI SSC FAQ 1588 clarifies how e-commerce merchants using provider-hosted iframes confirm they are not susceptible to script attacks for SAQ A eligibility under PCI DSS v4.0.1.
Shopify adds SubscriptionContractCalculation on GraphQL Admin API 2026-10 as the successor to SubscriptionDraft. Autoship apps should retest tax, payment methods, and commit handling before the stable cutover.
October 1 freezes script-tag writes, blocks updates for extensions on API 2025-07 or earlier, and makes API 2026-10 stable. Vendors must migrate before BFCM.
Meta joined Shopify Agentic Storefronts with Catalog sharing and direct checkout on by default. Restricted catalogs need an intentional toggle review.
Unauthenticated file upload CVE-2026-27540 in WooCommerce Wholesale Lead Capture is under active exploitation. Update to 2.0.3.2 and inspect uploads.
