Find published research by company, product, platform or technology.
Showing 1–20 of 29 dossiers
This is a patch-and-hunt event rather than a routine Commerce security release. Exploitation began before the vendor fix existed, and Adobe plus independent responders recommend remediation that goes beyond installing the hotfix when compromise is suspected.
Adobe Commerce and Magento merchants should treat CVE-2026-71362 as an urgent patch: independent security telemetry reports exploitation attempts even though Adobe’s bulletin still says it has not observed exploitation in the wild.
Hydrogen 2026-10 is generally available as a JavaScript commerce library with React Router and Next.js starters and examples for other frameworks. Existing Hydrogen storefronts still work; migration is optional.
Umami v3.4.1 fixes a critical Next.js next/og RCE, image-optimisation SSRF, cache poisoning, an MCP OAuth credential leak and other dependency flaws. Self-hosted users should upgrade and rebuild or pull fresh Docker images; no migration is required.
The October 8–15 ChatGPT referral dip was a tagging fault, according to an Adobe analyst who says OpenAI confirmed it privately. Mark the reporting gap; the lost attribution will not automatically reappear.
Muse packages persistent autonomous execution, credentials, payments, app access and memory into a mainstream consumer product. A September macOS hotfix now provides an early real-world lesson: agent containment has to protect not only the cloud runtime but also the local control path into the agent.
Shopify is turning off its old cross-merchant catalog REST API on November 2. The replacement is a UCP-compatible MCP server, not a renamed URL: agents must remap tools, payloads and saved-catalog identifiers.
WebMCP is no longer a Chrome-only browser experiment: Microsoft Edge now has its own active origin trial, while ChatGPT’s built-in browser and WordPress Playground show agent-client and platform implementation paths.
Financial advertisers in the US and Canada face a new Google Ads verification gate in 2027. Google will announce accepted registries and onboarding details before enforcement; it is not a current blanket ad ban.
Agent checkout builders using UCP 2026-08-25 can now negotiate consent options, propagate customer choices and handle missing-data warnings instead of hardcoding merchant privacy defaults.
Google Ads' new channel-priority controls offer a way to test Search partners and Display without giving them unrestricted budget, but the limits are not guarantees and Demand Gen has no allocation caps.
Shopify's new Events system can send the change and the data your app needs in one delivery. It's a significant alternative to classic webhooks, but not a forced shutdown or universal replacement yet.
The distribution shift matters beyond another sales-channel integration: product discovery, checkout, attribution and analytics can now happen off the merchant’s own storefront, and some familiar client-side pixels and checkout customizations do not travel with the order.
A new public MCP endpoint lets agents search without an API key and complete shopper-authorised purchases. It is separate from the Global Catalog REST API retirement and earlier browser-only WebMCP checkout; webhooks are not available at launch.
The migration risk is subtle: nothing breaks immediately, yet ERP, marketplace, POS and supplier integrations can become incomplete as soon as merchants start attaching multiple UPC, EAN, GTIN, ISBN or ASIN identifiers to one variant.
YouTube’s 2027 YPP restructuring changes entry, ongoing Shorts earnings and channel-activity rules. Since August 24, public views count from the first frame, while earnings and eligibility still depend on engaged or qualified views.
The stable Go/WebView desktop framework introduces a major architectural migration and richer native capabilities; Android/iOS are experimental and embedded untrusted frames remain a security concern.
Coolify 4.4.0 adds opt-in proxy traffic analytics, external secret managers, OIDC login, audit trails, Cloudflare DNS and experimental SQLite. Operators need to account for proxy restarts, Caddy redeploys and feature maturity.
Retailers can now submit warranty duration as structured product-feed data, but the new Google field does not replace Quebec's mandatory near-price disclosures or the underlying free repair guarantee.
The multi-retailer cart, previously previewed in May, is now available in the US. Price alerts, promo-code suggestions and Google Pay or merchant checkout could reshape how ecommerce sellers measure product discovery and conversion.