6 updates across 5 platforms, 2 needing action. Here’s everything in one place.
The US cybersecurity agency (CISA) has added a vulnerability nicknamed "PolyShell" to its list of known exploited flaws. It affects Adobe Commerce and Magento Open Source stores that haven't installed recent security updates. Adobe released a fix in its July 2026 security update.
Security researchers at Sansec report finding unwanted scripts on 953 online stores, most running Magento Open Source or Adobe Commerce, many of which had missed recent security updates. The scripts were hidden inside the stores' content blocks, which makes them harder for standard scans to spot.
Google's AI Mode is the chat-style search that answers questions directly. Google is now showing ads in it in 10 more countries, and says the UK is next, before the end of the year. In the US, ads can also appear on follow-up questions in the same conversation, labelled "Sponsored".
From 28 October, Meta started adding product browsing to existing ads unless advertisers opted out. When someone taps your ad, they can browse your products on a Meta page before going to your website.
Apps inside your Shopify admin can now open Sidekick, Shopify's built-in AI assistant, with a question already filled in. For example, an app could add an "Ask Sidekick" button next to a report, so you get help understanding it without leaving the app.
Amazon has switched on "FBA Returnless Resolutions" for sellers on Amazon.co.uk, Germany, France, Italy and Spain. You can let customers keep items worth up to £75 instead of sending them back, and still give a refund. Amazon doesn't pay you anything for the stock the customer keeps.