Action neededShopify · Changelog· Yesterday
What they said
“Leaked tokens can be used from any network location.”
If an agency or freelancer built a custom app for your store, it now needs an IP allowlist: a list of the only networks allowed to use it to reach your store's data. New installs need one from 20 November 2026, and existing apps from 1 January 2027.
Latest
Newest first · Last update 10 hours agoAction neededShopify
AI agents can look up a store's policies and FAQs (delivery, returns and so on) through a Shopify tool. That tool is being replaced by a new one called ask_business, which gives back a written answer. The old one stops being supported after 15 January 2027.
Yesterday · For developers65 days left
Action neededWooCommerce
WooCommerce 11.2.2 fixes several security problems, including making admin pages more secure. WooCommerce says to update as soon as possible. Some of the fixes came from an AI security scan of WooCommerce's code.
8 days ago · For founders, developers
Action neededAdobe Commerce
Security researchers at Sansec report finding unwanted scripts on 953 online stores, most running Magento Open Source or Adobe Commerce, many of which had missed recent security updates. The scripts were hidden inside the stores' content blocks, which makes them harder for standard scans to spot.
26 Oct · For founders, developers
Worth knowingWooCommerce
WooCommerce 11.3 is out this week. The sale badge can now show the discount as an amount or a percentage, such as "Save 25%". The Orders report can filter by payment method. You can also choose a refund and returns policy page, which Google can read. Product galleries swipe more smoothly on mobile.
2 days ago · For founders, developers
Worth knowingShopify
Apps inside your Shopify admin can now open Sidekick, Shopify's built-in AI assistant, with a question already filled in. For example, an app could add an "Ask Sidekick" button next to a report, so you get help understanding it without leaving the app.
28 Oct · For founders, developers
Action neededAdobe Commerce
Adobe released a critical security update for Adobe Commerce and Magento Open Source on 13 October 2026. Stores also need a separate hotfix released in September for another serious flaw. Adobe recommends changing your store's encryption keys and passwords as part of the fix.
13 Oct · For founders, developers
FYIWooCommerce
WooCommerce is changing how it handles security. Serious fixes now come out in their own quick updates instead of waiting for the next big release. From WooCommerce 11.2, extension makers can mark a security update as required. Connected stores with an active subscription then install it within about a day, even if automatic updates are turned off.
3 days ago · For founders, developers
Action neededAdobe Commerce
The US cybersecurity agency (CISA) has added a vulnerability nicknamed "PolyShell" to its list of known exploited flaws. It affects Adobe Commerce and Magento Open Source stores that haven't installed recent security updates. Adobe released a fix in its July 2026 security update.
27 Oct · For founders, developers
Action neededBigCommerce
BigCommerce has told merchants that a third-party app called Ribon had its access keys misused between 13 and 17 September, which exposed some shopper data in stores using the app. BigCommerce says its own platform was not affected, and it has removed the app.
21 Sept · For founders, developers