Shopify has a new store activity log that shows who changed what in your store, from products and discounts to themes, apps, staff and settings. It's in Settings > General > Store activity log and keeps up to 18 months of history, up from the last 250 events.
If an agency or freelancer built a custom app for your store, it now needs an IP allowlist: a list of the only networks allowed to use it to reach your store's data. New installs need one from 20 November 2026, and existing apps from 1 January 2027.
WooCommerce 11.3 was released on 11 November. The sale badge can now show the discount as an amount or a percentage, such as "Save 25%". The Orders report can filter by payment method. You can also choose a refund and returns policy page, which Google can read. Product galleries swipe more smoothly on mobile.
WooCommerce has released a security update for WooPayments, fixing an issue in the subscriptions features built into the plugin. Every recent version has a matching fix, such as 11.2.0 to 11.2.1. Anything older than 9.0.0 should go to 11.2.1.
The PHP project released fixes for two critical security issues on 21 October 2026. WooCommerce is telling store owners to update PHP on their servers straight away. No WooCommerce or WordPress update is needed.
Adobe released a security update for Adobe Commerce and Magento Open Source on 13 October 2026, covering versions 2.4.4 to 2.4.9. A separate hotfix for another issue isn't included in the October patch and has to be applied on its own.
Google Analytics now has hostname filters. You can make an approved list of website addresses, and only events from those addresses are counted in your property.
WooCommerce has fixed security issues in its Stripe Gateway plugin. Version 10.9.0 could store new customers' account passwords in plain text in some cases. Update to 11.2.0, or 11.1.2 if you need to stay on 11.1.x.
From 9 November, BigCommerce is gradually stopping product and variant image uploads in two old, rarely used formats: WBMP and XBM. Once the change reaches your store, uploading one of these files, in the control panel or through the API, gives an unsupported image format error. Images for modifiers, brands and categories aren't affected.
Apps inside your Shopify admin can now open Sidekick, Shopify's built-in AI assistant, with a question already filled in. For example, an app could add an "Ask Sidekick" button next to a report, so you get help understanding it without leaving the app.
Shopify has added protection against links that send customers from your store to other websites. After an update on 23 October, your store blocks links to sites Shopify has identified as malicious, asks customers to confirm before going to suspicious sites, and sends them straight through to all other sites with no message.
Stripe's Endive API version (2026-09-30.endive) removes the payment_method_types setting from Checkout Sessions and the matching option from Elements. It also deprecates the payment request button. These are breaking changes, so they only affect you when your developer upgrades to this API version.
Shopify is moving where you set up shipping. Instead of shipping profiles, shipping options will live inside Markets, so you manage where you sell and how you ship in one place. Stores could opt in from 1 October 2026, existing stores are being moved over as their apps become compatible, and it applies to every store from 1 July 2027.
AI agents can look up a store's policies and FAQs (delivery, returns and so on) through a Shopify tool called search_shop_policies_and_faqs. It's being replaced by a new tool called ask_business, which replies with a written answer. Shopify will maintain the old tool until 15 January 2027.
WooCommerce 11.2.2 is a security update that tightens several areas, including the Store API, REST API key checks and two admin pages that now need an administrator to be logged in. It also stops checkout going to payment if an order fails to save. WooCommerce says to update as soon as possible.
Stripe's October update lets you allow customers to pause their own subscriptions from the Stripe customer portal. Customers can also get back into an expired portal session by verifying their email address.
Adobe has set deadlines for Adobe Commerce on Cloud stores running old software. PHP 8.1 or older, Redis 5 or older and some other outdated services must be upgraded by 31 May 2027. Stores on Commerce 2.4.4 or 2.4.5 must upgrade or move to Adobe's SaaS version by 1 June 2027. Miss them and Adobe may switch your storefront off.
The WooCommerce PHP version requirement is going up: WooCommerce 11.6, planned for February 2027, will need PHP 8.1 or newer. Stores on PHP 7.4 or 8.0 can keep updating up to version 11.5, and WooCommerce 11.3 now shows a warning in your admin if your store is affected.