Six weeks before Black Friday, Google added one line to Merchant Center that should worry every flash-sale calendar.
From the help page on automatic item updates:
"Automations may not work for products with frequent price or availability value changes (for example, more than once per day). The product may be disapproved instead of updated if we detect a mismatch."
And then: "We may also stop updates if the total number of detected mismatches becomes too large."
No announcement. No published threshold. Hana Kobzová dated the edit to Sept 27, and Search Engine Roundtable flagged it Oct 8.
Here's why it bites in Q4.
Automatic item updates are the safety net that fixes your Shopping price when the feed lags behind the site. Hourly deals, doorbusters that sell out, a price that drops at midnight and returns at 6am: that's the exact pattern the net may now miss.
So your Black Friday best seller is the product most likely to sit in disapproved. Great timing.
Google's fix is the Merchant API. Plenty of stores on an app-based feed aren't there yet.
Account by account, before the sale calendar locks:
• Any SKU changing price more than once a day? Push it through the API or a feed refresh that runs as often as the price changes.
• Sale prices go in sale_price with dated sale windows, not hand-overwritten price.
• Check Needs attention for price mismatch the morning of every promo, doorbusters first.
From the help page on automatic item updates:
"Automations may not work for products with frequent price or availability value changes (for example, more than once per day). The product may be disapproved instead of updated if we detect a mismatch."
And then: "We may also stop updates if the total number of detected mismatches becomes too large."
No announcement. No published threshold. Hana Kobzová dated the edit to Sept 27, and Search Engine Roundtable flagged it Oct 8.
Here's why it bites in Q4.
Automatic item updates are the safety net that fixes your Shopping price when the feed lags behind the site. Hourly deals, doorbusters that sell out, a price that drops at midnight and returns at 6am: that's the exact pattern the net may now miss.
So your Black Friday best seller is the product most likely to sit in disapproved. Great timing.
Google's fix is the Merchant API. Plenty of stores on an app-based feed aren't there yet.
Account by account, before the sale calendar locks:
• Any SKU changing price more than once a day? Push it through the API or a feed refresh that runs as often as the price changes.
• Sale prices go in sale_price with dated sale windows, not hand-overwritten price.
• Check Needs attention for price mismatch the morning of every promo, doorbusters first.
If you run Aftersell, rotate its discount codes before BFCM. The app is still off the Shopify App Store.
Aftersell, the post-purchase upsell app Rokt owns, was attacked on Oct 7. Its disclosure says the data accessed included upsell settings, staff email addresses and discount codes for a small group of merchants.
Aftersell's Dhruv Patel put it at 22 stores.
No shopper data was exposed, per the company, and it says the hole was closed within two hours.
Aftersell's page tells merchants they don't need to take action. The app still works, and you can reinstall it through Settings > Apps > Uninstalled.
The attack was the modern kind: millions of requests rotating through 1,460 IP addresses, per Patel. Block one, the next one shows up.
A bot with better follow-through than most agencies.
Here's why it matters even if you're not one of the 22.
A leaked discount code doesn't stay leaked quietly. It ends up on coupon sites, in browser extensions, and at the checkout of people who were going to pay full price anyway.
Right before BFCM, that's margin walking out the door with a smile.
Account-by-account checklist:
• Stores running Aftersell: rotate the codes its offers use, and put usage limits on the ones you keep.
• Every app with access to discounts or checkout: who installed it, and whether anyone still needs it.
• Notified stores: expect phishing aimed at the staff emails that leaked.
Aftersell, the post-purchase upsell app Rokt owns, was attacked on Oct 7. Its disclosure says the data accessed included upsell settings, staff email addresses and discount codes for a small group of merchants.
Aftersell's Dhruv Patel put it at 22 stores.
No shopper data was exposed, per the company, and it says the hole was closed within two hours.
Aftersell's page tells merchants they don't need to take action. The app still works, and you can reinstall it through Settings > Apps > Uninstalled.
The attack was the modern kind: millions of requests rotating through 1,460 IP addresses, per Patel. Block one, the next one shows up.
A bot with better follow-through than most agencies.
Here's why it matters even if you're not one of the 22.
A leaked discount code doesn't stay leaked quietly. It ends up on coupon sites, in browser extensions, and at the checkout of people who were going to pay full price anyway.
Right before BFCM, that's margin walking out the door with a smile.
Account-by-account checklist:
• Stores running Aftersell: rotate the codes its offers use, and put usage limits on the ones you keep.
• Every app with access to discounts or checkout: who installed it, and whether anyone still needs it.
• Notified stores: expect phishing aimed at the staff emails that leaked.
If a client's site runs on PHP, check its version today. Attack traffic is already out there.
Two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, were disclosed on Oct 20. Both score 9.2 and can allow unauthenticated remote code execution, and Cloudflare has reported attack traffic against them.
The fix is the PHP runtime itself, not a plugin. Fixed releases:
• PHP 8.5.12
• PHP 8.4.27
• PHP 8.3.36
• PHP 8.2.35
PHP 8.1 and earlier get no regular upstream fix. Those need a backport from your host or distro, or an upgrade.
Qualys looked at 155 million installs with a known version. About seven in ten run end-of-life branches, and only 199,000 were patched in the first 12 hours.
The 2-minute check, per site:
• Ask the host whether PHP2Shell is patched. Managed hosts usually say so on a status page.
• On a VPS, confirm the build against your distro's advisory. Backported fixes can keep an older version number.
• Restart the PHP workers after updating. Running processes keep the vulnerable code in memory until they restart.
Shopify-hosted storefronts don't run PHP you manage. WordPress and WooCommerce sites do, and any app backend written in PHP is on its vendor's patch schedule.
Disabling session.upload_progress.enabled is PHP's interim step for one attack path. It reduces exposure and is not a fix.
Two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, were disclosed on Oct 20. Both score 9.2 and can allow unauthenticated remote code execution, and Cloudflare has reported attack traffic against them.
The fix is the PHP runtime itself, not a plugin. Fixed releases:
• PHP 8.5.12
• PHP 8.4.27
• PHP 8.3.36
• PHP 8.2.35
PHP 8.1 and earlier get no regular upstream fix. Those need a backport from your host or distro, or an upgrade.
Qualys looked at 155 million installs with a known version. About seven in ten run end-of-life branches, and only 199,000 were patched in the first 12 hours.
The 2-minute check, per site:
• Ask the host whether PHP2Shell is patched. Managed hosts usually say so on a status page.
• On a VPS, confirm the build against your distro's advisory. Backported fixes can keep an older version number.
• Restart the PHP workers after updating. Running processes keep the vulnerable code in memory until they restart.
Shopify-hosted storefronts don't run PHP you manage. WordPress and WooCommerce sites do, and any app backend written in PHP is on its vendor's patch schedule.
Disabling session.upload_progress.enabled is PHP's interim step for one attack path. It reduces exposure and is not a fix.
Shopify rolled back its leave-store prompt on Oct 22. Use the quiet to run one check.
The prompt went live Oct 20 and asked shoppers to confirm before leaving a storefront for an outside site. Merchants on Shopify's forums report it was pulled globally on Oct 22 while bugs get fixed.
The trusted-domains setting Shopify promised has also come off the changelog. There's no return date, so assume the prompt comes back.
For every store you manage:
• List each link that sends shoppers off-site: financing, booking, spec sheets, a help center, a second storefront.
• Pull outbound clicks for Oct 20 to 22 against the week before. The prompt was live for about two days, which is a clean test window.
• Note which of those domains you would add as trusted if the setting returns.
Shopify didn't tie the prompt to any incident. The timing follows the Oct 10 to 14 hijacks of three apps that sent checkout clicks to fake card pages, per Ecommerce Paradise's reporting.
A confirmation box was live for two days. That's roughly how long it takes a client to ask whether it explains the dip.
The prompt went live Oct 20 and asked shoppers to confirm before leaving a storefront for an outside site. Merchants on Shopify's forums report it was pulled globally on Oct 22 while bugs get fixed.
The trusted-domains setting Shopify promised has also come off the changelog. There's no return date, so assume the prompt comes back.
For every store you manage:
• List each link that sends shoppers off-site: financing, booking, spec sheets, a help center, a second storefront.
• Pull outbound clicks for Oct 20 to 22 against the week before. The prompt was live for about two days, which is a clean test window.
• Note which of those domains you would add as trusted if the setting returns.
Shopify didn't tie the prompt to any incident. The timing follows the Oct 10 to 14 hijacks of three apps that sent checkout clicks to fake card pages, per Ecommerce Paradise's reporting.
A confirmation box was live for two days. That's roughly how long it takes a client to ask whether it explains the dip.
Performance Max has two new asset toggles, and one was reportedly already on.
Search Engine Land reported on Oct 22 that PMax's Asset optimization settings now include Landing page images and Sourced videos. The advertiser who spotted them said Sourced videos was enabled automatically.
What the features do:
• Landing page images lets Google use images from your site as creative.
• Sourced videos lets Google use videos from other channels, including social, landing pages and linked YouTube channels, up to 10 per asset group.
Google's interface also says ads using these assets get an AI label in the EU, India and New York state.
The 2-minute check, per campaign:
• Open Asset optimization and see which of the two is on.
• Decide whether the client has usage rights to every video on the channels Google can pull from.
• Look at what actually got added before the next client call.
Google calls it expanding the creative library. It's also a creative director nobody hired, working from whatever is on the landing page.
Search Engine Land reported on Oct 22 that PMax's Asset optimization settings now include Landing page images and Sourced videos. The advertiser who spotted them said Sourced videos was enabled automatically.
What the features do:
• Landing page images lets Google use images from your site as creative.
• Sourced videos lets Google use videos from other channels, including social, landing pages and linked YouTube channels, up to 10 per asset group.
Google's interface also says ads using these assets get an AI label in the EU, India and New York state.
The 2-minute check, per campaign:
• Open Asset optimization and see which of the two is on.
• Decide whether the client has usage rights to every video on the channels Google can pull from.
• Look at what actually got added before the next client call.
Google calls it expanding the creative library. It's also a creative director nobody hired, working from whatever is on the landing page.
Check whether your Meta Sales campaigns still have a placement exclusion that works.
Meta's help center says Sales, Leads, Engagement and App promotion campaigns no longer let you choose placements manually at the ad set level. Awareness and Traffic keep manual placements.
Meta says the change is rolling out gradually, so two accounts on the same team can look different this week.
What Meta lists instead:
• Account-level exclusions, now settable by objective: Audience Network, Facebook Marketplace and the Facebook right column.
• Placement value rules that raise or lower bids by placement.
• Creative customization per placement. At least one asset is required for each placement, and ads won't deliver where the asset format isn't supported.
What to check this week:
• Which ad sets lean on a manual exclusion, and whether the reason was brand safety, legal or just performance.
• Whether the brand safety and legal ones now live in account controls.
• Whether the performance ones can be expressed as a value rule instead.
Meta also says Advantage+ placements delivered 10% lower cost per result in an experiment. It published no details of the experiment, so that's a number to test, not a forecast.
Meta's help center says Sales, Leads, Engagement and App promotion campaigns no longer let you choose placements manually at the ad set level. Awareness and Traffic keep manual placements.
Meta says the change is rolling out gradually, so two accounts on the same team can look different this week.
What Meta lists instead:
• Account-level exclusions, now settable by objective: Audience Network, Facebook Marketplace and the Facebook right column.
• Placement value rules that raise or lower bids by placement.
• Creative customization per placement. At least one asset is required for each placement, and ads won't deliver where the asset format isn't supported.
What to check this week:
• Which ad sets lean on a manual exclusion, and whether the reason was brand safety, legal or just performance.
• Whether the brand safety and legal ones now live in account controls.
• Whether the performance ones can be expressed as a value rule instead.
Meta also says Advantage+ placements delivered 10% lower cost per result in an experiment. It published no details of the experiment, so that's a number to test, not a forecast.
Meta's new terms start Oct 30. Check your Advantage+ AI toggles before then.
Per Adweek's reporting, the revised Commercial Terms add an "AI Features" section making advertisers "solely responsible" for what Meta's AI creates or changes in their ads. That includes features Meta switches on itself.
Agencies told Adweek they have already seen Meta add sitelinks, translations and AI images to live ads. Exverus pulled running ads to remove them.
Meta says advertisers can turn off individual Advantage+ features in Ads Manager at any time. It didn't directly answer whether the new terms cover features an advertiser never switched on.
For every account you run:
• Open each live campaign's creative enhancements and uncheck what the client didn't approve. Some of them sit in collapsed menus.
• Get written sign-off from the client on whichever AI features stay on.
• Screenshot the settings before Oct 30, so you can show what was on and when.
The current terms already treat an agency placing an ad as acting on the advertiser's behalf. Who pays when one toggle gets missed is now a client-contract question.
Meta describes the update as consolidating its AI ad terms. Housekeeping that moves the liability is still housekeeping, technically.
Per Adweek's reporting, the revised Commercial Terms add an "AI Features" section making advertisers "solely responsible" for what Meta's AI creates or changes in their ads. That includes features Meta switches on itself.
Agencies told Adweek they have already seen Meta add sitelinks, translations and AI images to live ads. Exverus pulled running ads to remove them.
Meta says advertisers can turn off individual Advantage+ features in Ads Manager at any time. It didn't directly answer whether the new terms cover features an advertiser never switched on.
For every account you run:
• Open each live campaign's creative enhancements and uncheck what the client didn't approve. Some of them sit in collapsed menus.
• Get written sign-off from the client on whichever AI features stay on.
• Screenshot the settings before Oct 30, so you can show what was on and when.
The current terms already treat an agency placing an ad as acting on the advertiser's behalf. Who pays when one toggle gets missed is now a client-contract question.
Meta describes the update as consolidating its AI ad terms. Housekeeping that moves the liability is still housekeeping, technically.
One old checkout extension can freeze a client's Shopify app. Since Oct 1, ones on API 2025-07 or older can't update.
Shopify's changelog says any app with checkout or customer account extensions on API 2025-07 or earlier "will be unable to be updated." The CLI checks every extension in the app, so one old one holds up the whole release.
The extensions keep running. What stops is the next version of the app, including a BFCM fix.
Before Nov 27:
• Ask each checkout app vendor which API version their extensions target. Shopify says 2025-10 and later use Polaris web components.
• Flag apps that haven't shipped an update since summer. That's my shortcut for the likeliest stuck ones, not a Shopify rule.
• Pick a fallback for any app that can't update, like a native checkout setting or a different app.
A code freeze nobody scheduled is still a code freeze.
Shopify's changelog says any app with checkout or customer account extensions on API 2025-07 or earlier "will be unable to be updated." The CLI checks every extension in the app, so one old one holds up the whole release.
The extensions keep running. What stops is the next version of the app, including a BFCM fix.
Before Nov 27:
• Ask each checkout app vendor which API version their extensions target. Shopify says 2025-10 and later use Polaris web components.
• Flag apps that haven't shipped an update since summer. That's my shortcut for the likeliest stuck ones, not a Shopify rule.
• Pick a fallback for any app that can't update, like a native checkout setting or a different app.
A code freeze nobody scheduled is still a code freeze.
The email worth sending every client this week:
"No new campaigns after November 13."
Every big change restarts learning: a new campaign, a new bid strategy, merged asset groups.
Smart Bidding needs time and conversions to settle. Black Friday week is the most expensive week to relearn.
So the calendar flips:
• Now to Nov 13: launch, restructure, test
• Nov 14 to Cyber Monday: budgets and targets only, in small steps
• December: read the results, then rebuild
Clients who hear this in October trust you in November.
Clients who hear it on November 25 think it's an excuse.
"No new campaigns after November 13."
Every big change restarts learning: a new campaign, a new bid strategy, merged asset groups.
Smart Bidding needs time and conversions to settle. Black Friday week is the most expensive week to relearn.
So the calendar flips:
• Now to Nov 13: launch, restructure, test
• Nov 14 to Cyber Monday: budgets and targets only, in small steps
• December: read the results, then rebuild
Clients who hear this in October trust you in November.
Clients who hear it on November 25 think it's an excuse.
Google may be pulling promotions from client landing pages into Search and PMax ads that have location assets.
Google's help page says it sources promotions from the landing page and attaches them to eligible Search and Performance Max campaigns that have location assets and no manual promotions. Each one is eligible to serve for less than 24 hours, and Google may turn it back on if it's still visible on the page.
The setting is at account level, so it has to be checked account by account.
What to check before Black Friday pages go live:
• Assets > More (three dots) > Account level automated assets > Advanced settings > Automated promotions.
• Assets > Asset type "Promotion," then look for "Google AI" under "Added by."
• Segment reports by click type to see what the promotions drove.
• If a promotion needs exact dates or terms, upload it manually. Campaigns with manual promotions are skipped.
Google's help page says it sources promotions from the landing page and attaches them to eligible Search and Performance Max campaigns that have location assets and no manual promotions. Each one is eligible to serve for less than 24 hours, and Google may turn it back on if it's still visible on the page.
The setting is at account level, so it has to be checked account by account.
What to check before Black Friday pages go live:
• Assets > More (three dots) > Account level automated assets > Advanced settings > Automated promotions.
• Assets > Asset type "Promotion," then look for "Google AI" under "Added by."
• Segment reports by click type to see what the promotions drove.
• If a promotion needs exact dates or terms, upload it manually. Campaigns with manual promotions are skipped.
Google is moving Merchant Center user access to passkeys.
For agencies, that turns a settings page into a client access problem.
What it touches:
• Shared logins that three people use. Those stop working cleanly.
• Ex-employees who still have admin on a client's Merchant Center.
• Client accounts where only the agency has admin, and the founder can't get in.
The 20-minute version for every client:
• List every user on the Merchant Center account
• Remove anyone who left
• Make sure the client owns at least one admin seat
• Give each person their own login
Do it before Black Friday. The day a feed breaks is a bad day to find out nobody can log in.
For agencies, that turns a settings page into a client access problem.
What it touches:
• Shared logins that three people use. Those stop working cleanly.
• Ex-employees who still have admin on a client's Merchant Center.
• Client accounts where only the agency has admin, and the founder can't get in.
The 20-minute version for every client:
• List every user on the Merchant Center account
• Remove anyone who left
• Make sure the client owns at least one admin seat
• Give each person their own login
Do it before Black Friday. The day a feed breaks is a bad day to find out nobody can log in.
Google's new channel prioritization can't be set from a manager account.
Each client account or campaign gets done on its own.
Per Google's help page, the controls became available progressively from Oct 15. You set High or Low priority per channel, optionally with a budget allocation percentage on Low channels.
The date that matters is February 2027, when Search campaigns with Display Expansion enabled migrate automatically. To keep today's behavior, Google says to set the Google Display Network to Low with a 50% allocation.
What to do now:
• List client Search campaigns with the Display Network on. Those are the ones that migrate.
• Flag Target Impression Share campaigns. Google says the Display Network won't serve on them.
• Plan on the interface. API and Editor support is listed as "coming soon."
Each client account or campaign gets done on its own.
Per Google's help page, the controls became available progressively from Oct 15. You set High or Low priority per channel, optionally with a budget allocation percentage on Low channels.
The date that matters is February 2027, when Search campaigns with Display Expansion enabled migrate automatically. To keep today's behavior, Google says to set the Google Display Network to Low with a 50% allocation.
What to do now:
• List client Search campaigns with the Display Network on. Those are the ones that migrate.
• Flag Target Impression Share campaigns. Google says the Display Network won't serve on them.
• Plan on the interface. API and Editor support is listed as "coming soon."