eCommerce Roundup October 2026

October 2026 opened with a supply chain attack on Shopify checkout pages, escalated to Adobe’s largest security patch of the year, and closed with two vulnerabilities confirmed actively exploited landing on CISA’s Known Exploited Vulnerabilities list the same day. Shopify shipped its most feature-dense edition to date. Bain projected BFCM will cross $85 billion for the first time. Here is everything that mattered.

Platform Updates

October 10 to 18: Shopify Checkout Phishing Attack via Third-Party Apps

Attackers compromised at least three Shopify apps and planted code that intercepted the checkout click, redirecting shoppers to a lookalike page that captured card details before forwarding them to the real checkout. Shopify’s platform was not breached. Hulk Product Options was compromised October 10, Selleasy on October 13, and Swym Wishlist Plus had two incidents on October 14 and October 18 before Swym disabled the app globally.

Merchants who ran these apps during those windows should audit checkout scripts and check theme assets for unauthorized files before BFCM. The number of affected stores and cards captured has not been made public.

October 13: Adobe Commerce APSB26-153 - 11 Vulnerabilities, Two Unauthenticated RCEs

Adobe patched 11 vulnerabilities across Adobe Commerce and Magento Open Source on October 13, with five rated Critical. CVE-2026-103849 carries a CVSS 10.0 and allows arbitrary code execution without authentication; CVE-2026-92909 carries a CVSS 9.8 and does the same through the B2B component. Affected versions span Adobe Commerce 2.4.4 to 2.4.9, Adobe Commerce B2B 1.3.3 to 1.5.3, and Magento Open Source 2.4.6 to 2.4.9.

Adobe was not aware of active exploitation at time of release, but the hotfix for CVE-2026-75650 from APSB26-146 must also be applied alongside this patch. Teams that have not confirmed both are in place should do so before BFCM traffic begins.

Also Read: PHP2Shell and Adobe Commerce: What Every Store Needs to Patch, Check and Protect

October 27: Node2Shell and PolyShell Added to CISA KEV - Federal Deadline November 10

CISA added two actively exploited vulnerabilities to its KEV catalog on October 27 with a federal remediation deadline of November 10. CVE-2026-111497, named Node2Shell (CVSS 9.2), is an out-of-bounds write in Node.js’s native Brotli decoder exploitable without authentication through crafted HTTP payloads; it is fixed in Node.js 22.23.4, 24.22.1, and 26.12.1. CVE-2026-48356, named PolyShell (CVSS 9.3), allows unauthenticated webshell upload through Adobe Commerce and Magento’s guest cart REST API and is covered by APSB26-153 and APSB26-73.

Teams running unpatched Node.js or Adobe Commerce in production should treat both as active breach risks, not scheduled maintenance items.

October 28: Shopify Fall ‘26 Edition - 150+ Updates

Shopify released its Fall ‘26 Edition, named “Exponential,” on October 28, with Shop Pay now working inside AI agents including Meta’s Muse, Claude Duet, and Instinct. Nine agents including ChatGPT, Claude, Gemini, and Copilot can connect to a store, browse its catalog, and complete purchases; merchants manage agent-facing content through a new Agent knowledge base under Sales Channels > Agentic. Stores without a terms of service, privacy policy, or refund policy are ineligible for in-chat checkout on Google AI Mode and the Gemini app.

Shopify Protect is rolling out ahead of BFCM with custom fraud rules, AI-generated chargeback responses, and automatic delivery proof. Apps can no longer create or update script tags and must migrate to theme app extensions or web pixels; expiring OAuth tokens must be migrated before January 2027 to remain listed on the App Store.

Industry Updates

The Holiday Season Numbers: BFCM Forecast Crosses $85 Billion

Bain & Company forecasts BFCM weekend sales will surpass $85 billion, up 8.75% year over year, with consumer intent to participate at a recorded high of 70%, up from 64% in 2025. Bain also forecasts US holiday season sales will top $1 trillion for the first time.

Deloitte puts holiday eCommerce sales at $316.1 billion to $318.9 billion for November 2026 through January 2027, up 7.5% to 8.4% year over year, with total retail holiday spending forecast at $1.70 trillion to $1.71 trillion. For merchants, the message across both forecasts is the same: demand is high and AI-driven channels are becoming a meaningful share of where it lands.

Amazon Prime Big Deal Days: $9.86 Billion Across October 6 to 7

Adobe Analytics reported US online spending across all retailers reached $9.86 billion during Amazon’s October event, up 8.5% from 2025, with mobile accounting for 52% of sales. The largest category lifts versus the September daily average were headphones and speakers at 300%, smartwatches at 255%, and toys at 158%.

For merchants, the event confirmed October as a genuine demand window ahead of BFCM. The average household spent $114 across multiple orders, with 54% placing two or more, which suggests promotional strategies that drive repeat visits outperform single discount pushes.

Upcoming Events

BFCM 2026

November 27 to 30. Black Friday falls on November 27 and Cyber Monday on November 30. Bain projects the four-day weekend will generate over $85 billion in US online sales. Shopify’s Rollouts feature allows catalog, discount, and checkout changes to be scheduled and activated as a single launch before the day.

November 10

CISA KEV Federal Remediation Deadline. Federal agencies must remediate Node2Shell (CVE-2026-111497) and PolyShell (CVE-2026-48356) by November 10. The deadline applies equally to any team running unpatched Node.js or Adobe Commerce in production.

November 2026

EU Product Identifier Requirement for Shopify Shipping. Merchants using Shopify Shipping or Managed Markets for EU direct-to-consumer parcels under 150 euros must have GTINs, EANs, UPCs, or ISBNs on all products. Missing identifiers can block label purchases and trigger customs rejection ahead of peak shipping season.

March 1, 2027

Shopify Script Tags Full Cutoff. Script tag injection into storefronts ends permanently on March 1, 2027. The Fall ‘26 Edition has already removed the ability to create or update script tags, and apps still relying on them must migrate to theme app extensions or web pixels before that date.