eCommerce Roundup September 2026

September 2026 arrived with the most severe security event in Adobe Commerce's history, a Shopify platform expansion that makes every eligible store reachable by AI agents at checkout, and the first major holiday season forecasts that confirmed what platform developments had been signaling all year. The brands that spent September firefighting a zero-day vulnerability are entering Q4 behind the ones that spent it preparing for BFCM. Here is everything that mattered.

Platform Updates

September 4 to 8: Adobe Commerce StyleSmuggler CVE-2026-75650

September 2026 is not a normal Adobe Commerce security month. Adobe released two separate security bulletins within 24 hours for Adobe Commerce and Magento Open Source. It was an emergency Priority 1 update for CVE-2026-75650 on September 7, followed by the regularly scheduled September security update on September 8. The distinction matters because the monthly September patch does not include the CVE-2026-75650 hotfix. Both must be applied independently.

Dutch e-commerce security firm Sansec confirmed the first exploitation of CVE-2026-75650, codenamed StyleSmuggler, at 22:20 UTC on September 4, 2026. The vulnerability carries a CVSS score of 10.0, the maximum possible severity rating, and requires no authentication. It abuses Magento's template system through PHP code injection triggered by the Payment Transaction Failed Reminder email. A fully patched store running Adobe's July and August 2026 updates was compromised within hours of the first confirmed exploitation.

Adobe published emergency security bulletin APSB26-146 on September 7, three days after the first confirmed exploitation. StyleSmuggler deploys a Rust-based Linux backdoor that disguises itself as a legitimate system process and restarts automatically via cron. Patching closes the vulnerability but does not remove an existing compromise. Any store that was accessible between September 4 and September 7 without the hotfix applied needs a forensic scan, full credential rotation, and confirmation that no secondary backdoors were installed.

September 8: Adobe Commerce as a Cloud Service September Release

Adobe Commerce as a Cloud Service published its September 8 release to Production, containing all changes from Adobe Commerce version 2.4.9. The update introduced new GET and PUT /V1/system/config REST API endpoints that allow integrations to read and update Commerce system configuration values programmatically. Development teams can now synchronize configuration across staging and production environments through API calls rather than manual Commerce Admin reconfiguration.

September 15: Shopify Admin New Look Rolls Out

Starting September 15, the Shopify admin began rolling out progressively to merchants with a redesigned interface covering color, typography, spacing, and icons.

• Search, notifications, and the store picker moved to side navigation.
• Sidekick moved from a side panel to a floating chat at the bottom of the screen.
• Apps using Admin UI extensions pick up the new styles automatically. Apps that use Polaris Web Components 1.0 remain unchanged until the developer chooses to migrate to Polaris 2.0.

The rollout is progressive and merchants will see it at different times through October.

September 21: Shopify Analytics Session Measurement Change

Starting September 21, 2026, Shopify changed how it counts sessions in Analytics. Merchants comparing session data across this date will see a visible change in reported numbers that reflects the new measurement methodology rather than a real change in traffic. Any dashboard or reporting setup that trends sessions from September 21 needs to be annotated and rebaselined before BFCM planning decisions are made based on that data.

September 25: Shopify Tax to Automatically Tax Return Shipping Fees from October 23

Starting October 23, 2026, Shopify Tax and Tax Platform will automatically tax return shipping fees like other shipping charges for US merchants. The change is automatic for merchants using Shopify Tax or Tax Platform, meaning no manual configuration is required. Merchants using manual workarounds to calculate, collect, import, or reconcile tax on return shipping fees should review those processes before October 23 to avoid double-counting tax on the same transaction.

September 28: Shopify Opens Checkout to Browser-Based AI Agents

On September 28, Shopify announced WebMCP support for checkout, including Shop Pay for all eligible merchants. Browser-based AI agents can now read the checkout, update order details, and complete purchases with buyer authorization. Shopify had previously supported WebMCP for storefronts and carts, allowing AI agents to search products and add items to the cart. The September 28 update extends that capability to full purchase completion.

The announcement followed Shopify CEO Tobias Lütke's confirmation one week earlier of a partnership with Meta to enable Meta's Muse agent to shop and check out with Shop Pay on all Shopify stores. Shopify also confirmed that Instinct, a personal AI shopping agent, can now search Shopify's merchant network for live product information including prices, sizes, and availability. For merchants on Shopify, every eligible store is now reachable by AI agents from product discovery through purchase, with no additional configuration required.

Industry Updates

The 2026 Holiday Season Numbers: AI Drives the Forecast

September brought the first major holiday season forecasts for 2026 and the numbers are the clearest signal yet that AI commerce is a present revenue channel. BFCM 2026 will be the first major shopping event where AI agents actively shop on behalf of buyers at scale.

For Shopify and Adobe Commerce merchants, the commercial implication is specific. Product pages that AI agents cannot read will not appear in AI-driven holiday recommendations regardless of how strong the SEO or paid media investment is. The brands that invested in catalog readiness and structured product data in September are the ones that will appear in AI recommendations during BFCM and Cyber Week. The brands that did not will find their products absent from a channel that is already generating one in five visits.

TikTok Shop Tightens Fulfillment and Seller Requirements

TikTok Shop rolled out a Seller Center navigation update on September 7 that relocated where daily tools live, arriving alongside new order packaging requirements and updated shipping and fulfillment policies published September 3. TikTok Shop is now actively enforcing fulfillment metrics consistent with a delivery-performance marketplace: a Late Dispatch Rate at or below 4% and an On-Time Delivery Rate at or above 80%.

For Shopify merchants selling through TikTok Shop, these requirements need to be operational before BFCM traffic arrives. A seller center that cannot meet the fulfillment standards during peak volume faces the same consequences as one that misses them during a normal week, at significantly higher cost to the business.

Upcoming Events

BFCM 2026: November 27 to 30

Black Friday and Cyber Monday fall on November 27 to 30, 2026. With eight weeks from today, the preparation window is closing. Adobe's forecast of $47.5 billion in Cyber Week online sales and 130% growth in AI-driven retail traffic confirm this will be the most commercially significant and technically demanding BFCM in eCommerce history. Merchants who have not confirmed checkout extensibility status, tracking pixel migration, infrastructure scaling, and AI product discovery readiness should treat October as the last viable preparation window before the November code freeze.

Also Read: Shopify BFCM Checklist 2026: What Most Merchants Miss Until It Costs Them

Shopify API 2026-10: October 1

The Shopify API 2026-10 version releases on October 1. Alongside this release, new carrier services created via the Admin API will no longer automatically add rates to the General shipping profile and will require manual configuration. API version 2025-10 is retired on October 16, 2026. Any custom apps or integrations built on that version will stop working after that date. Development teams should audit every custom integration before October 1 to confirm compatibility with 2026-10.

Amazon Business Reshape: Nashville, October 2026

Amazon's fifth annual B2B commerce conference takes place in Nashville in October 2026. The event covers AI-driven procurement, quantity-tier pricing, and the expansion of B2B buyer-facing features to third-party sellers. For brands operating both B2B and DTC commerce, Reshape is the highest-signal Amazon event of the year for wholesale strategy.