Magento’s PolyShell Flaw, Hijacked Shopify Checkouts, Fall ’26 Edition, and What to Do Before Black Friday
One detail from October’s security news is worth reading twice.
Sansec reported a Magento store running 2.4.7-p10, fully patched, that was reinfected an hour after a clean scan.
The patch was not the problem. The attacker had been inside earlier and had already left a rogue admin account and a backdoor behind. Patching closes the door. It does nothing for the person who is already in the house.
That one story is a fair summary of the month.
October was a security month for every platform we work on. Magento’s PolyShell flaw joined CISA’s list of exploited vulnerabilities. Shopify apps were hijacked into sending shoppers to fake checkouts. PHP shipped critical fixes that attackers started poking at within days. In the middle of all that, Shopify’s Fall ’26 Edition put checkout inside Google’s AI Mode and Gemini, WooCommerce reworked how AI agents connect to a store, and Adobe forecast a record $275.1 billion US holiday season.
This is issue one of the MageBytes Commerce & AI Roundup, a monthly note for people who run or build online stores. As a Magento Development Company and a Shopify Development Company that also builds on WooCommerce and BigCommerce, we read these bulletins whether we want to or not. Below is what happened, what it means, and what we would do before Black Friday.
The short version: If you do one thing before Black Friday, audit what code runs on your storefront and checkout. That means every app, every tag, every admin account, and the PHP version underneath it all. The rest of this issue is detail, and some of it is useful.
In this issue: Security watch, platform updates, AI and agentic commerce, market numbers, key dates, what we recommend before BFCM, and a short FAQ.
Security Watch
27 Oct Magento PolyShell added to CISA’s Known Exploited Vulnerabilities list
CISA added CVE-2026-48356, known as PolyShell and scored CVSS 9.3, to its Known Exploited Vulnerabilities catalogue on 27 October. US federal agencies have until 10 November to remediate. The same update added CVE-2026-111497, called Node2Shell, a flaw in the Brotli decoder used by Node.js and other HTTP stacks.
PolyShell lets an attacker upload files through Magento’s REST API. Adobe fixed it in Magento 2.4.9 in May and backported the fix to older release lines in July (APSB26-73). So the fix has been sitting there for months. What changed in October is that CISA now says people are actively using the hole. Sansec, who named and documented PolyShell, has the original technical write up.
Days before the CISA listing, Sansec reported a campaign that has infected 953 stores, most of them Magento, since July 2025. The attackers hide a small JavaScript loader in the cms_block database table. That is exactly where file-based malware scanners do not look. A scanner that only reads files will cheerfully tell you everything is fine. Coverage in The Hacker News has the wider picture.
What it means for merchants: Patching closes the door, but it does not remove anyone who is already inside. If your store ran an unpatched version between March and July, check cms_block and cms_page for injected scripts, review every admin user, scan for backdoors and webshells (including in pub/media), and rotate admin and API credentials. If nobody on your team owns this kind of work, it is a good moment to hire Magento developers or bring in a partner who does.
13 Oct Adobe Commerce security update APSB26-153
Adobe’s October bulletin fixes 11 vulnerabilities rated critical, high and medium across Adobe Commerce, Magento Open Source and Adobe Commerce B2B. The possible impacts include arbitrary code execution, privilege escalation, arbitrary file writes and security feature bypass. Adobe says it is not aware of exploits in the wild and rates the update priority 2.
The line that matters more sits right next to it. Adobe also asks merchants to apply the separate hotfix for CVE-2026-75650 (APSB26-146, September). That critical flaw scores CVSS 10.0, it is being exploited, and the October patches do not include its fix. If you patched in October and assumed you were covered, go and check that the September hotfix is on there too. The bulletin also marks 2.4.10-alpha1, the first preview of the next release line.
What it means for merchants: Apply the October patch for your version and confirm the September hotfix is installed. Test in staging first, especially third-party extensions and custom checkout code. This is routine work for any team doing Adobe Commerce Development, and it is the first thing that gets skipped in a busy quarter.
10 to 18 Oct Shopify apps hijacked into fake checkouts
From 10 October, some shoppers on Shopify stores were sent to a lookalike checkout page when they clicked Checkout. The page captured their card details and then passed them on to the real checkout, so orders looked completely normal. Nothing obvious tipped merchants off.
HulkApps (Hulk Product Options), Selleasy and Swym confirmed that an unauthorised party had changed what their apps loaded on some storefronts. No source has reported a breach of Shopify’s own checkout. The weak point was trusted third-party JavaScript. Many apps were pulled from the App Store during the month while reviews ran.
What it means for merchants: List every app that injects code into your storefront, remove the ones you no longer use, and test checkout yourself in a private browser window, watching the domain at every step. This is a client-side supply chain problem, so it applies just as much to Magento, WooCommerce and BigCommerce stores.
21 Oct Critical PHP security releases
PHP shipped critical fixes for two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, nicknamed PHP2Shell. Attackers began trying to exploit them within days. Magento, WooCommerce and most self-hosted commerce stacks run on PHP, so this is about the server underneath your store, not just the application on top of it.
What it means for merchants: Ask your host or DevOps team to confirm your PHP version is patched. On managed hosting, get that confirmed in writing rather than assuming it has been done. If you do not have anyone watching the server layer, proper DevOps Services for Ecommerce pay for themselves in months like this one.
Platform Updates
28 Oct Shopify Fall ’26 Edition, called Exponential
Shopify’s second Edition of the year shipped more than 150 updates, a month earlier than last year’s December release. The ones most merchants will actually feel:
- Checkout inside Google AI Mode and Gemini. Rolling out in the US, Canada and Australia, and on by default for eligible stores. It needs Google Merchant Center and complete store policies. Subscriptions, bundles and customisable products are not supported yet.
- Shop Pay inside personal AI agents, including Meta’s Muse. Shoppers approve each purchase and can set spending budgets.
- Sidekick plans, in early access. Shopify’s AI assistant can stage up to 50 admin changes for you to review and approve together.
- Shopify Protect. Blocks near-certain fraud and card-testing bots before payment authorisation.
- Rollouts. Schedule a theme change, checkout, discounts and market catalogs as one launch event, with automatic rollback.
- Coming later. Checkout custom fields will not arrive before BFCM.
Two housekeeping items buried in the same month. API version 2025-10 was retired on 16 October, and since 1 October apps can no longer create or update storefront script tags. Notice that first bullet again too: on by default. Plenty of merchants will find their products being offered in a place they have never looked at.
What it means for merchants: Your product data, policies and compare-at prices now feed AI shopping channels directly, so they need to be accurate. Freeze theme changes until after Cyber Monday, and schedule the script tag migration before the March 2027 cutoff. Stores that want help with either can talk to a Shopify Development Company that does this daily.
7 to 9 Nov WooCommerce 11.2 is out, 11.3 lands the week of 9 November
WooCommerce 11.2 (7 October) added CSV product import that matches by GTIN, date fields at checkout, and a configurable order withdrawal flow. The 11.3 beta is a big one, with 1,310 commits from 117 contributors. Three changes are worth knowing about before you click update:
- MCP connection. 11.3 removes the old WooCommerce MCP endpoint. AI agents now connect through the WordPress MCP Adapter plugin, using application passwords.
- Sale badges. They can now show the discount amount or percentage.
- Refunds API. The refunds endpoint now validates line-item amounts, so some integrations will start getting 400 or 422 errors.
WooCommerce also announced that version 11.6 will require PHP 8.1 or later.
What it means for merchants: If you connect Claude, ChatGPT or another agent to your store over MCP, plan the migration before upgrading to 11.3. Check that any ERP or accounting integration that creates refunds still works, because that is exactly the kind of quiet breakage that shows up at month end. Our WooCommerce Development Services and CRM & ERP Development Services teams are already testing against the beta. Put PHP 8.1 on the 2027 roadmap.
AI and Agentic Commerce
AI agents went from pilots to live sales channels this year, and October made that concrete. Three developments show how far it has moved:
- Shopify. Fall ’26 lets AI agents and apps use a store’s catalog, cart and checkout.
- Adobe Commerce. Adobe has committed to Google’s Universal Commerce Protocol (UCP), the OpenAI and Stripe Agentic Commerce Protocol (ACP) and the Agent Payments Protocol (AP2). It also ships a Commerce MCP Server that gives AI agents secure, real-time access to catalog, cart, pricing and orders.
- WooCommerce. Product and order abilities are exposed to agents through MCP by default.
Adobe expects AI-driven traffic to US retail sites to grow about 130 percent this holiday season. In its survey, 77 percent of shoppers who used AI said they felt more confident in their purchase. That second number is the one to sit with. People are not just browsing with these tools. They are buying with more confidence because of them.
The MageBytes view: Agentic commerce rewards stores with clean, structured data. That means complete attributes, accurate stock and prices, clear shipping and return policies, and fast APIs. B2B gains the most, because reorders, quotes and approvals are repetitive enough for agents to handle. The groundwork that makes a store ready for agents also improves SEO and conversion today.
If you want the longer version, we have written about getting products recommended by ChatGPT and AI assistants and about why AI agents are replacing if-this-then-that automation. Both explain the thinking behind this section in more detail. For stores on Adobe Commerce, preparing for agents is mostly data and API work, which is where good Adobe Commerce Development earns its keep.
Market Numbers
The numbers below are forecasts and early estimates from Adobe, Redseer and Datum Intelligence. Treat them as direction, not gospel.
United States
- Holiday 2026 (Adobe forecast): $275.1 billion online from 1 November to 31 December, up 6.7 percent.
- Cyber Week: $47.5 billion.
- Cyber Monday (30 November): $15.1 billion, the biggest day of the season.
- Black Friday: $12.9 billion. At up 9.2 percent it is growing fastest, helped by earlier discounts.
- Mobile: 57.4 percent of holiday spend.
- Buy now, pay later: $21.3 billion.
- October: Adobe expected $95.8 billion online, up 8 percent, helped by Amazon’s Prime Day event on 6 and 7 October.
India
- Amazon’s Great Indian Festival and Flipkart’s Big Billion Days opened on 8 October. Redseer estimates about ₹24,000 crore in sales in the first two days, led by mobile phones.
- Datum Intelligence forecasts ₹1.5 to ₹1.55 lakh crore in online festive sales for 2026, with Diwali on 8 November.
The figure that matters most to us is the mobile one. If 57.4 percent of holiday spend happens on a phone, then the mobile checkout is the store for most of the season. That is true whether the phone is running your site in a browser or your own app, and it is why our Mobile App Development Company and web teams look at checkout on real devices before anything else.
Key Dates
8 Nov 2026 Diwali, the peak of India’s festive season. Affects: Indian D2C and marketplace sellers
10 Nov 2026 CISA deadline for PolyShell and Node2Shell. It is a US federal deadline, and a sensible one for everyone else too. Affects: Magento and Adobe Commerce, Node.js stacks
Week of 9 Nov 2026 WooCommerce 11.3 release. Affects: WooCommerce stores using MCP or the refunds API
27 Nov 2026 Black Friday. Your code freeze should already be in place. Affects: Everyone
30 Nov 2026 Cyber Monday, forecast at $15.1 billion in US online sales. Affects: Everyone
1 Jan 2027 Shopify public apps must use expiring offline access tokens. Affects: Shopify app developers
1 Mar 2027 Shopify storefront script tags stop loading. Affects: Shopify stores with older apps or custom scripts
What We Recommend Before BFCM
Six things, in roughly the order we would do them. None of them is exotic. Most of them get skipped because nobody owns them.
1. Patch and verify
Apply APSB26-153 and the CVE-2026-75650 hotfix on Magento and Adobe Commerce, and confirm your PHP version is patched. Verify means look at the server, not at the ticket that says it was done.
2. Hunt for what is already inside
Check cms_block and cms_page for injected scripts, review admin users, and scan for webshells and backdoors. A patched store can still be a compromised store.
3. Audit third-party scripts
List every app or tag that runs on storefront and checkout pages, remove the unused ones, and add a Content Security Policy. Every script you cannot explain is a script someone else can change.
4. Test checkout by hand
Go through checkout in a private window, on mobile and on desktop, for every payment method. Watch the address bar at each step. It takes an hour and it is the single check that would have caught October’s fake checkouts.
5. Freeze and load test
Load test at three to five times normal traffic, then freeze code by mid-November. If the test says the frontend is what falls over, Hyvä Theme Development is the long term answer for Magento stores. It is not a project to start the week before Black Friday, though.
6. Get your data ready for agents
Fill product attributes and GTINs, publish clear shipping and return policies, and make sure compare-at prices are accurate. This is the same work that helps your SEO, so it is rarely wasted.
Need a second pair of eyes? MageBytes offers a free pre-BFCM security and performance check for Adobe Commerce, Magento, Shopify, WooCommerce and BigCommerce stores. We review patches, admin users, third-party scripts and checkout, and send you a prioritised fix list within 48 hours. Book your check.
Frequently Asked Questions
Is my Magento store safe if I installed the latest patches?
Not necessarily. Sansec found the PolyShell era loader on a fully patched store, because attackers who got in earlier had left admin accounts and backdoors behind. Patching has to be paired with a compromise check.
Was Shopify’s checkout hacked in October?
No source has reported a breach of Shopify’s own checkout. Attackers changed the code that some third-party apps loaded on storefronts, and that code sent shoppers to a fake checkout. Merchants should audit installed apps and test checkout manually.
What is agentic commerce?
It is shopping carried out by an AI agent on behalf of a person: finding products, comparing them and completing checkout inside tools such as Google AI Mode, Gemini or ChatGPT. Standards such as UCP, ACP and MCP connect those agents to stores.
Does WooCommerce 11.3 break my AI or MCP integration?
It might. Version 11.3 removes the old /wp-json/woocommerce/mcp endpoint. Integrations need the WordPress MCP Adapter plugin and an application password instead.
How big will Black Friday and Cyber Monday 2026 be?
Adobe forecasts $12.9 billion in US online sales on Black Friday and $15.1 billion on Cyber Monday, within a $275.1 billion holiday season.
Where MageBytes Fits
MageBytes is an Ecommerce Website Development Company based in Noida. We build and look after stores on Magento and Adobe Commerce, Shopify, WooCommerce and BigCommerce, and we connect them to the systems behind them. That includes CRM & ERP Development Services, DevOps Services for Ecommerce and, where an app genuinely earns its place, a Mobile App Development Company team. If you want a view of your own store against the checklist above, book the free pre-BFCM check and we will send you a prioritised list within 48 hours.
Sources
- Adobe Security Bulletin APSB26-153
- Adobe Security Bulletin APSB26-146
- CISA Known Exploited Vulnerabilities catalogue
- CISA alert: two Known Exploited Vulnerabilities added, 27 October 2026
- Sansec: PolyShell research
- The Hacker News: Hackers infect 953 online stores
- The Hacker News: Adobe Commerce PolyShell attacks breach hundreds of stores
- SecurityWeek: 953 online stores infected
- Fudge: Shopify checkout phishing attack
- Fudge and Shopify developer notes: Shopify Fall ’26 Edition
- WooCommerce developer notes: WooCommerce 11.3 and the MCP Adaptor updates
- Adobe: Agentic commerce standards
- Adobe holiday forecast 2026
- YourStory: ₹24,000 crore in the first two festive days (Redseer)
- Zoutons: India festive sales statistics 2026
Get a Free Pre-BFCM Security and Performance Check MageBytes reviews patches, admin users, third-party scripts and checkout on Adobe Commerce, Magento, Shopify, WooCommerce and BigCommerce stores, and sends a prioritised fix list within 48 hours. Book your check.
About MageBytes
MageBytes is a software and ecommerce development company based in Sector 63, Noida, India. We build, secure and support ecommerce platforms on Magento, Adobe Commerce, Shopify, WooCommerce and BigCommerce for enterprise and mid-market clients across 30 countries. Twelve years of delivery.
Sector 63, Noida, Uttar Pradesh. magebytes.com
