Thursday, October 22, 2026
News For Internet Marketers
PCI SSC FAQ 1588 clarifies how e-commerce merchants using provider-hosted iframes confirm they are not susceptible to script attacks for SAQ A eligibility under PCI DSS v4.0.1.
Square told merchants to purge CBD and hemp catalog items by October 15, 2026, ahead of federal hemp dates that later shifted under P.L. 119-103. Processor calendars, not statutes, set settlement risk.
Square directed sellers to remove CBD, hemp, and hemp-derived items by October 15, 2026. Processor deadlines can arrive before federal hemp dates shift.
Shopify adds SubscriptionContractCalculation on GraphQL Admin API 2026-10 as the successor to SubscriptionDraft. Autoship apps should retest tax, payment methods, and commit handling before the stable cutover.
October 1 freezes script-tag writes, blocks updates for extensions on API 2025-07 or earlier, and makes API 2026-10 stable. Vendors must migrate before BFCM.
Meta joined Shopify Agentic Storefronts with Catalog sharing and direct checkout on by default. Restricted catalogs need an intentional toggle review.
Unauthenticated file upload CVE-2026-27540 in WooCommerce Wholesale Lead Capture is under active exploitation. Update to 2.0.3.2 and inspect uploads.
