Patch Now, Thank Yourself Later: E-commerce News Roundup (15–23 October 2026)

Welcome to our weekly e-commerce news roundup. This week, 15 to 23 October 2026, was unusually intense: two critical security flaws landed within twenty-four hours of each other, one for PHP and one for Node.js. Meanwhile, Google switched on its Universal Cart in the US, the European Parliament voted to lighten waste-compliance paperwork for small businesses, and fresh figures confirmed that European e-commerce keeps growing. Here is what changed, and what it means for your store.

PHP2Shell: the flaw that put (almost) every PHP store on the clock

On 21 October, the PHP project patched two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619, quickly nicknamed PHP2Shell) that allow an attacker, without any login, to run code on your server. Both score 9.2 out of 10 in severity, and the faulty code has been sitting in PHP since 2012 (version 5.4).

Because the flaw lives in PHP itself, not in your store's code, even a perfectly maintained shop is exposed. Researchers demonstrated attacks against Magento, WooCommerce (WordPress), Drupal, Joomla, Laravel and Symfony; platforms like PrestaShop, Sylius or OpenCart are in the same boat. One of the two bugs can also leak server memory (think passwords, session tokens or API keys) through a simple cookie.

The good news: mass exploitation looks less likely than initially feared, because attacks require very specific server conditions. The bad news: attempts were observed hours before the patch even went public, and CISA is urging everyone to patch immediately.

What you should do: update PHP everywhere (the fixed versions are 8.2.35, 8.3.36, 8.4.27 and 8.5.12) and restart your PHP workers, because the update does nothing until you do. If your store still runs PHP 8.1 or older, there is no official fix; patched packages exist through most Linux distributions, but treat this as your final warning to plan an upgrade. A temporary workaround exists: blocking file-upload requests (multipart/form-data) at the web server with a four-line nginx rule. But it breaks legitimate uploads like product images and some checkout forms, so it is a seatbelt, not a cure.

Node2Shell: Node.js got its own scare the very same week

Same day, same story, different runtime. Node.js fixed CVE-2026-111497, a flaw in Brotli, the compression library bundled into Node, and researchers at Imperva then showed they could turn it into remote code execution on an official Node.js image. They call it Node2Shell.

If your stack runs on Node.js (that is the case for Medusa or Vendure backends and most modern JavaScript storefronts), check your version: the fixed releases are 22.23.4, 24.22.1 and 26.12.1. Two important nuances: Node.js 20 and older will never receive the fix (they are end-of-life, so plan a migration), and the vulnerable code is often reached through middleware you didn't write: Express 5's body parsers decode Brotli automatically. Also remember to rebuild your Docker images: bumping a version number in a config file does not patch a binary already baked into a container.

No real-world attacks have been reported so far, and Imperva needed several attempts on a specific setup, but there is no workaround inside Node.js itself. Upgrading is the only fix.

Google launches its Universal Cart: US first, Europe later

On 15 October, Google switched on its Universal Cart in the US, inside Search and the Gemini app. Shoppers can save products from multiple retailers into one persistent cart, get alerts when prices drop or items come back in stock, see promo codes and payment-perk suggestions, and check out with Google Pay, with merchants like Nike, Sephora, Target, Walmart and many Shopify stores already on board. Crucially, the merchant remains the seller of record: the order, the confirmation and the customer relationship stay yours.

Under the hood sits the Universal Commerce Protocol (UCP), an open standard Google introduced in January with Shopify, Walmart, Target and others, designed so that any AI agent, not just Google's, can discover products and complete purchases through one common language.

You might also hear about WebMCP, and the two are easy to confuse. In short: WebMCP lets an AI agent operate your website on behalf of the user (clicking through your pages in their browser), while UCP lets agents talk commerce directly with your back office (catalog, cart, checkout). They complement each other rather than compete; Shopify, for example, supports both.

What it means for you: nothing to deploy today in Europe: the checkout feature is limited to eligible US merchants, with global expansion promised "in the coming months". But the direction is clear: your product data quality in Google Merchant Center will soon determine whether AI agents can sell your products at all. Clean feeds and complete attributes: that is homework you can start now.

Brussels moves to simplify waste rules for small businesses

A quick reminder: under Extended Producer Responsibility (EPR), anyone selling products in the EU pays fees to finance recycling, and must appoint an authorised representative in every single member state where they sell. For a small French brand shipping to ten countries, that is ten representatives to pay.

On 20 October, the European Parliament overwhelmingly backed (616 votes for, 9 against) suspending that representative obligation for EU-based micro and small companies (fewer than 50 employees, under €10M turnover) in sectors including packaging, batteries, textiles, footwear and electronics. The suspension would apply until 2035. EPR fees and recycling obligations themselves do not change; this is purely about cutting redundant administrative overhead.

One caveat: this is the Parliament's position, not yet the final law; negotiations with member states still need to conclude. But for small cross-border sellers, it is a genuinely encouraging signal from Brussels.

European e-commerce: €911 billion, and cross-border is the growth engine

Finally, some perspective. The European E-commerce Report 2026 (Ecommerce Europe / EuroCommerce) values European B2C e-commerce at €911 billion in 2025, up 7% year-on-year, with around 5% growth forecast for 2026 (~€961 billion). Three quarters of Europeans now shop online.

Where is the momentum? Cross-border. The 100 largest marketplaces in Europe are expected to generate €175.8 billion in GMV, 79.5% of it from cross-border sales. Within the EU, the five largest markets are France (€112B), Germany (€94B), Spain (€68B), Italy (€59B) and Poland (~€43B), with Southern and Eastern Europe growing the fastest.

The takeaway for merchants: your next customers increasingly live in another EU country. Selling across borders is getting structurally easier (see the EPR story above): those who prepare their international setup early will ride this growth instead of watching it pass by.

Frequently asked questions

What to watch next week

• Patch status: whether PHP2Shell exploitation attempts scale up despite the tricky conditions; keep monitoring after updating.
• Node.js 20 migrations: hosting and platform providers will increasingly force the issue; better to choose your moment.
• Google UCP: any signal of a European rollout of Universal Cart or UCP-powered checkout.
• EPR simplification: the file now moves to negotiations between the Parliament and member states; the final scope could still shift.

See you next week. And if patching PHP and Node.js across your whole stack feels like a lot, that is exactly the kind of week we are here for.