Shopify has a new store activity log that shows who changed what in your store, from products and discounts to themes, apps, staff and settings. It's in Settings > General > Store activity log and keeps up to 18 months of history, up from the last 250 events.
If an agency or freelancer built a custom app for your store, it now needs an IP allowlist: a list of the only networks allowed to use it to reach your store's data. New installs need one from 20 November 2026, and existing apps from 1 January 2027.
WooCommerce 11.3 was released on 11 November. The sale badge can now show the discount as an amount or a percentage, such as "Save 25%". The Orders report can filter by payment method. You can also choose a refund and returns policy page, which Google can read. Product galleries swipe more smoothly on mobile.
WooCommerce 11.2.2 is a security update that tightens several areas, including the Store API, REST API key checks and two admin pages that now need an administrator to be logged in. It also stops checkout going to payment if an order fails to save. WooCommerce says to update as soon as possible.
Apps inside your Shopify admin can now open Sidekick, Shopify's built-in AI assistant, with a question already filled in. For example, an app could add an "Ask Sidekick" button next to a report, so you get help understanding it without leaving the app.
The PHP project released fixes for two critical security issues on 21 October 2026. WooCommerce is telling store owners to update PHP on their servers straight away. No WooCommerce or WordPress update is needed.
Adobe released a security update for Adobe Commerce and Magento Open Source on 13 October 2026, covering versions 2.4.4 to 2.4.9. A separate hotfix for another issue isn't included in the October patch and has to be applied on its own.
Google Analytics now has hostname filters. You can make an approved list of website addresses, and only events from those addresses are counted in your property.
WooCommerce has fixed security issues in its Stripe Gateway plugin. Version 10.9.0 could store new customers' account passwords in plain text in some cases. Update to 11.2.0, or 11.1.2 if you need to stay on 11.1.x.
WooCommerce is changing how it handles security. Serious fixes now come out in their own quick updates instead of waiting for the next big release. From WooCommerce 11.2, extension makers can mark a security update as required. Connected stores with an active subscription then install it within about a day, even if automatic updates are turned off.
WooCommerce has released a security update for WooPayments, fixing an issue in the subscriptions features built into the plugin. Every recent version has a matching fix, such as 11.2.0 to 11.2.1. Anything older than 9.0.0 should go to 11.2.1.
Stripe's October update lets you allow customers to pause their own subscriptions from the Stripe customer portal. Customers can also get back into an expired portal session by verifying their email address.
Shopify has added protection against links that send customers from your store to other websites. After an update on 23 October, your store blocks links to sites Shopify has identified as malicious, asks customers to confirm before going to suspicious sites, and sends them straight through to all other sites with no message.
Stripe's Endive API version (2026-09-30.endive) removes the payment_method_types setting from Checkout Sessions and the matching option from Elements. It also deprecates the payment request button. These are breaking changes, so they only affect you when your developer upgrades to this API version.
New UK rules for subscriptions start on 1 January 2027, brought forward from spring 2027. They cover auto-renewing subscriptions sold to UK consumers, including product subscriptions like refills and boxes. Businesses will need to give clearer information before sign-up, send reminders before renewals, and let customers cancel easily.
AI agents can look up a store's policies and FAQs (delivery, returns and so on) through a Shopify tool called search_shop_policies_and_faqs. It's being replaced by a new tool called ask_business, which replies with a written answer. Shopify will maintain the old tool until 15 January 2027.
From 9 November, BigCommerce is gradually stopping product and variant image uploads in two old, rarely used formats: WBMP and XBM. Once the change reaches your store, uploading one of these files, in the control panel or through the API, gives an unsupported image format error. Images for modifiers, brands and categories aren't affected.
Under the UK's drip pricing rules, if delivery is a fee every customer has to pay, it must be included in the price you show. In an open letter on 2 November 2026, the CMA reminded online shops that this applies everywhere a price appears, from ads and product pages to the basket and checkout.
On 27 October 2026, the US cybersecurity agency (CISA) added a Magento flaw nicknamed "PolyShell" to its list of issues known to be used in real attacks. It affects Adobe Commerce and Magento Open Source stores that haven't installed recent security updates. Adobe released the fix in its July 2026 security update.
Adobe has set deadlines for Adobe Commerce on Cloud stores running old software. PHP 8.1 or older, Redis 5 or older and some other outdated services must be upgraded by 31 May 2027. Stores on Commerce 2.4.4 or 2.4.5 must upgrade or move to Adobe's SaaS version by 1 June 2027. Miss them and Adobe may switch your storefront off.
The WooCommerce PHP version requirement is going up: WooCommerce 11.6, planned for February 2027, will need PHP 8.1 or newer. Stores on PHP 7.4 or 8.0 can keep updating up to version 11.5, and WooCommerce 11.3 now shows a warning in your admin if your store is affected.
Shopify is moving where you set up shipping. Instead of shipping profiles, shipping options will live inside Markets, so you manage where you sell and how you ship in one place. Stores could opt in from 1 October 2026, existing stores are being moved over as their apps become compatible, and it applies to every store from 1 July 2027.