FYIWooCommerce · News· 3 days ago
What they said
“Now our default is to give security fixes their own releases.”
WooCommerce is changing how it handles security. Serious fixes now come out in their own quick updates instead of waiting for the next big release. From WooCommerce 11.2, extension makers can mark a security update as required. Connected stores with an active subscription then install it within about a day, even if automatic updates are turned off.
Latest
Newest first · Last update 10 hours agoAction neededAdobe Commerce
The US cybersecurity agency (CISA) has added a vulnerability nicknamed "PolyShell" to its list of known exploited flaws. It affects Adobe Commerce and Magento Open Source stores that haven't installed recent security updates. Adobe released a fix in its July 2026 security update.
27 Oct · For founders, developers
Action neededAdobe Commerce
Security researchers at Sansec report finding unwanted scripts on 953 online stores, most running Magento Open Source or Adobe Commerce, many of which had missed recent security updates. The scripts were hidden inside the stores' content blocks, which makes them harder for standard scans to spot.
26 Oct · For founders, developers
Action neededBigCommerce
BigCommerce has told merchants that a third-party app called Ribon had its access keys misused between 13 and 17 September, which exposed some shopper data in stores using the app. BigCommerce says its own platform was not affected, and it has removed the app.
21 Sept · For founders, developers