SEO & AI Weekly, Oct 19–25: Shopify App Hijacks & PHP RCE

From October 19 to 25, 2026, Google’s status page showed no new core update or spam update, and there were two rounds of unconfirmed ranking volatility, on October 20–21 and on October 24. However, the most urgent issues this week were about security, and they follow one pattern. In the three Shopify apps that were hijacked to redirect checkout, the UpdraftCentral key leak, and last week’s Rank Math incident, the problem was in a third-party component or an external connection key. The two unauthenticated remote code execution vulnerabilities in PHP, by contrast, are in the underlying runtime. Shopify then added link protection to online stores and asked app developers to complete security checks within the week.

Platform rules and AI search data also changed in smaller ways. Meta pushed the effective date of its new business terms back to November 20. Although the terms dropped the word “train,” the permission to crawl advertisers’ websites remains. ChatGPT ads expanded to 89 countries, and from October 30, automatic copy rewriting and landing page replacement will be on by default.

On the data side, rank trackers are still receiving fake results, and the share of anomalies each vendor measured varies widely. SISTRIX tested 96,418 URLs and found no measurable relationship between llms.txt and AI citations. Among the 100 websites Marie Haynes analyzed, sessions from ChatGPT were only 0.62% of sessions from Google organic search. These numbers show that GEO is still changing quickly, so store owners should get the basics of their sites right first and then respond to these changes.

Key points

Each point is labeled by urgency: Act now means affected sites should take action this week, Watch means there is a deadline or the situation is still changing, and For reference covers research and documentation updates.

• Act now: Starting October 10, three Shopify apps (Hulk Product Options, Selleasy, and Swym Wishlist Plus) were tampered with one after another and used to inject redirect code into storefronts. On October 20, Shopify added link protection to online stores and asked app developers to complete security checks this week.
• Act now: On October 21, PHP released 8.5.12, 8.4.27, 8.3.36, and 8.2.35, which fix two vulnerabilities that allow unauthenticated remote code execution. Security vendors report exploitation in the wild. The impact is very broad and includes a large number of WordPress sites. Google’s John Mueller recommended returning a 503 status code during downtime for patching.
• Act now: The TeamUpdraft website was breached and UpdraftCentral connection keys leaked. Attackers used the keys to create admin accounts and install backdoor plugins on WordPress sites. The fixed versions are UpdraftPlus 1.26.13 and 2.26.13.
• Act now: OpenAI announced that ChatGPT ads are expanding to 26 more countries, for a total of 89. From October 30, creative enhancements will be on by default for self-serve ads, which lets the system rewrite copy and change landing pages.
• Watch: Meta pushed the effective date of its new business terms back to November 20. The terms removed the word “train,” but the clause that allows Meta to crawl advertisers’ websites remains. This roundup corrects what we said last week.
• Watch: Nozzle data for October 21 show that 35.7% of desktop results on pages 1–2 were replaced, higher than on any day from October 12 to 20. Ahrefs estimates that 5% to 20% of results are affected. As before, Google has not commented.
• For reference: SISTRIX analyzed 96,418 URLs and found no measurable relationship between llms.txt and AI citations. Glenn Gabe’s retest found that ChatGPT, Claude, and Perplexity still cannot read body content rendered with JavaScript.

Three Shopify apps hijacked to redirect checkout; Shopify adds link protection and asks developers to audit their apps

Starting October 10, customers at several Shopify stores were sent to fake payment pages after they clicked checkout. No source indicates that Shopify’s own checkout system was breached; the problem was in third-party apps. A technical analysis by developer Roman Zipp shows that attackers tampered with the configuration of third-party apps and injected a script of about 22.7 KB into storefronts. The script hooked into the click event of the checkout button, sent customers to fake domains ending in .top, collected their card details, and then sent them back to the real checkout page. Because customers still completed payment on the real checkout page, orders looked normal in the merchant admin, so it is hard to notice the problem from order data alone.

Developers have confirmed three affected apps so far, and in each case the entry point traces back to the app vendor’s own admin or tools (statements compiled by Roman Zipp). Hulk Product Options was hit on October 10, and the developer called it “a wide attack that also impacted multiple Shopify apps.” Selleasy’s attack window was 07:47 to 15:00 UTC on October 13, and the developer admitted that “An unauthorized party gained access to an internal Selleasy tool.” The app claims more than 49,000 active stores, but the developer did not disclose how many stores were affected. In an update on October 22, Zipp said all the affected apps he listed had been fixed or removed.

The third app, Swym Wishlist Plus, was hit on October 14 and then attacked a second time. On October 20, Swym published an incident FAQ. It suspended the app for all merchants and revoked Shopify access for all Swym apps, and as of October 25 it was still restoring access in batches. Swym said there was no evidence that merchant data or customers’ personal information leaked through the app, but if customers manually entered information on an external site, that data may have leaked. The FAQ lists four domains: checkout-guard[.]top, account-confirm[.]top, billing-confirm[.]top, and checkout-secure[.]top. Merchants also reported problems with other apps this week, but neither the developers nor Shopify confirmed them, so this roundup does not name them.

Boost AI Search & Filter also had an outage in the same period. Boost Commerce’s official status page shows that from 22:38 UTC on October 17, the app’s theme app extension was turned off in all stores, and Shopify re-enabled it at 18:48 UTC on October 18. During the outage, Boost collection and search pages in Turbo stores could not load, and many pages were blank. The status page does not explain why the extension was turned off, so it is not yet possible to tell whether this is related to the hijacking. But for stores that use Boost to run their collection pages, blank pages can affect indexing if Googlebot happened to crawl them during those two days. We recommend checking crawl activity for October 17 to 19 in Search Console, and then using URL Inspection to confirm that collection pages now render the product list.

After these incidents, Shopify added restrictions on two fronts: storefront blocking and developer requirements. On October 20, Shopify announced link protection in its merchant changelog. At first, the rule was that the online store shows a confirmation dialog before sending visitors to an external site (except domains connected to the store and supported social networks). Some merchants reported that country switcher links between two of their own stores also triggered the dialog, so on October 23 Shopify narrowed the rule: sites judged malicious are blocked, suspicious sites show a confirmation dialog, and other external links work as normal. Shopify did not publish the criteria. Earlier, on October 20, Shopify had also published Securing your app, together in the developer changelog, which asks every app developer to complete eight security actions this week. They include scanning the app with shopify app security check, moving to expiring access tokens, treating all rendered data (including metafields) as untrusted and escaping it, and turning on two-step verification for hosting, CDN, code repositories, and email. Shopify also said it will tighten permissions for storefront app code, add IP restrictions to app secrets, and raise security requirements for the App Store. It gave no timeline for these three items, and the post does not name any incident. But given the attack path, they are aimed at two problems: third-party apps with overly broad permissions, and the lack of limits on long-lived tokens after they leak.

Shopify merchants should immediately add a product to the cart in a private window and click checkout, to confirm that they end up on Shopify’s own checkout page. Stores that have installed Swym should search the theme code for checkout-guard and turn off Swym in App embeds for now. However, finding nothing in the theme code does not mean the store was unaffected, because the malicious code can be injected at runtime in the browser through config returned by the app’s API. So treat the private-window checkout test as the real check and watch for notices from app developers. If needed, open the Network panel in the browser’s developer tools and check whether checkout makes requests to unfamiliar domains. Uninstall apps you do not use as soon as possible to reduce the attack surface of storefront scripts, and turn on two-step verification for Shopify and each app’s admin.

Two high-risk issues for self-hosted sites: PHP remote code execution and leaked UpdraftCentral keys

This week the risk for Shopify stores centered on storefront scripts, while for self-hosted WordPress and WooCommerce sites it lay in the server runtime and admin privileges.

The first issue is in the underlying runtime. On October 21, the PHP project released 8.5.12, 8.4.27, 8.3.36, and 8.2.35, which fix CVE-2026-109618 and CVE-2026-109619. Both vulnerabilities are in the PHP interpreter itself, both have a CVSS v4.0 score of 9.2, and attackers can execute code remotely without logging in. PHP wrote in the release notes: “There are no complete mitigations, updating is the only safe choice.” Because the vulnerabilities are not in WordPress or plugins, updating only WordPress core, plugins, and themes does nothing. On October 23, PHP issued another advisory for CVE-2026-115560 in the session upload progress feature, and recommended setting session.upload_progress.enabled=0 until the next regular release.

The impact is broad. Patchstack, citing Wiz Research, says every PHP version from 5.4 onward is affected by at least one of the vulnerabilities. PHP-FPM, Apache mod_php, php-cgi, and LiteSpeed are all in scope, and PHP considers mod_php the highest risk. PHP 8.1 and earlier no longer get official releases, so they depend on hosting providers or Linux distributions to ship their own patches (the version number may not change after patching), and PHP 8.2 will also reach the end of security support on December 31, 2026. On exploitation in the wild, security firm Sucuri quoted Hadrian: “We are now seeing php2shell exploited in the wild at scale.” Patchstack’s timeline shows that hosting partners had reported exploitation by the morning of October 21, but as of 13:57 UTC that day, Patchstack’s own telemetry showed only probing and no confirmed compromises. Although vendors see different levels of exploitation, probing has already started, so sellers with self-hosted sites must have their hosting provider confirm that the PHP version their site actually runs has been upgraded or patched, and should not rely only on the PHP version shown on the command line (Shopify-hosted stores do not need to do anything).

On the same day, the PHP Foundation published a post on how the vulnerabilities were found. Early signs of the problem behind CVE-2026-109618 were found during an external security audit in 2024, but the fix involved compatibility trade-offs and was never settled. On August 11, 2026, the security firm Calif reported an unconditional remote code execution path, OpenAI independently reported the same root cause, and Wiz later reported further attack vectors. The foundation also said that AI-assisted research means the security team now receives far more reports than before. It has published 15 CVEs since July 1 and worked through more than 100 reports that were invalid, duplicates, or not reproducible.

Upgrading PHP may require a short restart or downtime. On October 21, John Mueller reminded site owners on Bluesky: “use HTTP 503 instead of letting responses time out / 404 / 500.” He suggested returning the 503 outside PHP, for example by pointing DNS elsewhere or letting the CDN handle it. On the same day, Google Search Central also posted on LinkedIn that returning a 503 lets indexed URLs stay in search results during maintenance.

Besides PHP itself, the WordPress plugin ecosystem had another supply chain security incident this week. As with last week’s Rank Math PRO backdoor and this week’s Shopify app hijacking, the problem was on the vendor side. TeamUpdraft, the developer of the backup plugin UpdraftPlus, published a security incident notice saying that teamupdraft.com was accessed without authorization on October 17–18, and that its customer database and the connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone may have leaked. The plugin download packages were not tampered with, and self-hosted UpdraftCentral is not affected. But attackers used the leaked keys directly to send commands to connected sites through the UpdraftCentral remote management channel, create admin accounts, and install backdoor plugins disguised as maintenance tools. BleepingComputer, citing Patchstack data, reported that the attack started at 15:32 UTC on October 18 and used at least 99 differently named backdoor plugins. An analysis by security firm Nethemba recorded that on October 21, attackers were still sending commands to two of its sites. TeamUpdraft has not disclosed how many sites were affected or the root cause of the breach.

On the fix side, UpdraftPlus 1.26.13 (free) and 2.26.13 (Premium) automatically revoke old keys, but two details are easy to miss. Nethemba points out that the previous versions, 1.26.12 and 2.26.12, had a bug and did not delete any old keys. In addition, 1.26.13 only deletes keys created before 13:07 BST on October 18, so keys created after that time and before the fixed version was released must still be removed manually. For this reason, sites using UpdraftPlus must confirm they have upgraded to 1.26.13 or 2.26.13, and then manually delete all connection keys in the UpdraftCentral settings, and check the plugin and user lists for anything unfamiliar.

Two other plugin vulnerabilities also need attention:

• Rank Math SEO PRO follow-up: There was no substantive new information on last week’s backdoor incident this week, and Rank Math has still not disclosed how many users were affected or how the breach happened. Its changelog confirms that the clean 3.0.124 was released on October 16, while the original 3.0.123 was released on October 7, and the tampered package reused the same version number. This means you cannot tell from the version number alone whether you were affected. You must check whether the plugin was downloaded or updated between 20:02 UTC on October 15 and 07:12 UTC on October 16.
• Duplicator vulnerability: On October 20, Wordfence disclosed CVE-2026-82814 (CVSS 8.8) in the migration plugin Duplicator. It affects the free version 1.5.17 and earlier and the Pro version 4.6.10 and earlier, and the fixed version is 5.0.0, released on September 8. Attackers first write malicious data into the site’s public content, and the attack is triggered when an admin packages and runs a migration. There are no reports of exploitation in the wild so far, but Wordfence warns that upgrading the plugin does not rebuild migration packages that already exist, so old packages should be deleted and built again.

Meta pushes its business terms back to November 20, but the website crawling permission remains

Last week’s roundup said “Meta removed the clause on October 17.” That was not accurate, and we correct it here. Meta only removed the word “train” from the stated purposes in the terms, and the clause that allows Meta to crawl advertisers’ websites remains. Search Engine Journal compared the versions and found that the original purpose was “to provide, develop, improve, research, train, and maintain the integrity of,” and it now reads “to provide, develop, improve, research, and maintain advertising and business products.”

In response to the controversy, a Meta spokesperson told Reuters by email on October 23: “We are extending the effective date of our updated Commercial Terms and Self-Serve Ad Terms to 20 November.” According to PPC Land, Meta said the delay gives it more time to explain to partners what has changed and what has not. However, when we opened Meta’s Chinese-language terms preview page on October 26, the effective date on the page was still October 30. So for now, the delay exists only in Meta’s statements to the media, and the official documents have not been updated.

In the text itself, Section 1 of the current terms authorizes Meta to use automated software such as web scrapers, intelligent assistants, bots, and web crawlers, and to create test credentials, in order to access, index, cache, analyze, collect, retrieve, or crawl domains, web pages, or URLs associated with your products or services. These terms apply to every business that uses Meta products for commercial purposes, including businesses that only run a Page and do not advertise, and the full text of the terms does not mention robots.txt. Meta spokesperson Daniel Roberts told The Verge that the update “does not change how Meta uses web crawlers.” Publishers are still applying pressure. Movement for an Open Web has filed competition complaints with the UK CMA and the European Commission, and the US News/Media Alliance sent an open letter on October 22 asking Meta to answer by October 26 which crawlers it uses, how it complies with robots.txt, and other questions. For now, these interpretations are the complainants’ claims, not regulatory findings.

According to Meta’s crawler documentation, Meta has five user-agents, and they follow robots.txt differently. Meta-ExternalAgent is used to train foundation models or index content directly, Meta-WebIndexer is used to improve the quality of Meta AI search results, and Meta-ExternalAds is used for advertising and business products. FacebookExternalHit, which fetches links shared in the apps, and Meta-ExternalFetcher, which fetches pages on user request, are different: the documentation states clearly that they may not follow robots.txt in some cases. For stores that use Meta business accounts or run ads, the deadline has moved from October 30 to November 20, and we recommend checking your robots.txt rules for the first three crawlers before then. Also check your server logs to see how often these five crawlers actually visit.

ChatGPT ads expand to 89 countries, and self-serve ads turn on automatic rewriting by default

On October 21, OpenAI announced that ChatGPT ads are expanding to 26 more countries (14 in Latin America, the rest in Europe, the Middle East, Africa, and Asia), for a total of 89. Ads only appear on the Free and Go plans, and Plus, Pro, and Enterprise have no ads. OpenAI said more than 100,000 advertisers have run ads in the eight-plus months since launch, but this is a cumulative figure. The Information, citing estimates from New Street Research, said there were about 60,000 active advertisers in early October. The two numbers come from different sources, but the gap suggests that many advertisers may have tried ads and not continued.

For merchants who are already running ads, the more important change is the new default setting that takes effect on October 30. An OpenAI email published by Search Engine Roundtable shows that from October 30, creative enhancements will be on by default for both new and existing self-serve campaigns. When it is on, the system can rewrite or write new headlines and descriptions, translate copy, and resize images. The destination URL “may be optimized to direct people to a relevant page on your website,” and these versions “can run automatically without requiring you to review or approve each version.” Advertisers can opt out in Ads Manager, and existing opt-out settings are kept. As with Google Ads, turning on this kind of AI feature means giving up some control. Of course, in many cases AI does better than the average ad manager :)

On the same day, OpenAI published a post on the underlying architecture of its ad system. Search Engine Journal reported that a post-trained large language model understands the conversation, generates retrieval queries, and nominates candidate ads, while a separate auction system handles the final ranking, pricing, and selection. When users turn on ad personalization, the system also considers non-sensitive information from past conversations. In the announcement, OpenAI repeated that “advertising does not influence the answers ChatGPT provides,” and stressed that the ad system and the system that generates answers use different services and models. But as SEJ pointed out, this is OpenAI’s own claim and cannot be verified from outside (shrug).

For online stores, automatic landing page replacement can easily go wrong. For example, an ad that was meant to promote a best-selling product could send people to a discontinued product page, an out-of-stock variant page, or a promotion page with expired prices. Merchants running ChatGPT ads should decide in Ads Manager before October 30 whether to turn off creative enhancements. If you keep it on, first check your site for outdated pages that have not been cleaned up. In your reports, also track visits from paid ChatGPT clicks separately from visits driven by organic citations.

Unconfirmed ranking volatility, and rank trackers report very different shares of fake results

Search Engine Roundtable reported on October 21 and October 25 on two rounds of unconfirmed ranking volatility, on October 20–21 and on October 24 (a Saturday). The most recent confirmed update on Google’s status page is still the September 2026 spam update, which started on September 24 and ended on October 8. Because most forum reports came from news sites and sites that rely on Discover, it is unclear how well these two rounds represent what ecommerce sites saw.

What matters more for day-to-day decisions is that third-party rank trackers are still receiving fake results, and the problem got worse again this week. On October 21, Nozzle updated its research data, based on 56.1 million results pages tracked by its customers in 53 countries. By Nozzle’s definition, a results page counts as replaced if fewer than half of the sites that usually rank for that keyword are present. Since September 13, the replaced share has averaged 8.7% for page 1 alone, and 22.6% for page 1 or 2 on desktop (the normal baseline is only 0.28%). The share fell to 3.8%–8.3% on October 14–16, but jumped to 35.7% on October 21. On October 22, Nozzle published a second report, which found that since September 16, 13.9% of results pages answered only part of the query.

The numbers several tool vendors published this week vary widely when put side by side:

• Ahrefs (October 22): Depending on the data provider, it estimates that 5% to 20% of results are affected. It has added filters and cleaned up historical data.
• AccuRanker: Sampling 1 in every 200 keywords, it measured anomalies on 30.2% of desktop results pages on September 25, falling to 0.58% on October 17.
• DataForSEO: The anomaly rate was about 20% to 30% at first and fell to about 2% to 3% after it added validation and retries.

These numbers range from 0.58% to 35.7% because each tool collects data, defines anomalies, and cleans data differently, so they cannot be compared directly. AccuRanker explained that the drop to 0.58% was the result of its own team’s work, so it cannot be taken as evidence that Google has stopped interfering. In addition, AccuRanker switched to a new dynamic CTR model at 09:00 UTC on October 21. As a result, Share of Voice calculated with dynamic CTR will fall by about 35% to 60% for most domains. This is only a change in the estimation method and does not mean that actual traffic fell. Google has still not responded publicly to the fake results. Any sharp single-day drop that rank trackers have shown since mid-September should first be checked against impressions, clicks, and average position in Search Console, and pages should only be changed after a real drop is confirmed. Teams that use AccuRanker should add an annotation for October 21 in their reports.

AI search research: llms.txt has no measurable effect, and AI still sends little traffic

First, do not spend time on llms.txt unless you have already got your pages’ basic HTML structure and server-side rendering right. The AI citation study SISTRIX published on October 22 analyzed 17,380 domains and 96,418 URLs in ChatGPT, AI Mode, and AI Overviews in German-speaking markets in Q2 2026, pairing each cited page with an uncited page on the same domain. The results show that llms.txt has no measurable effect: 11.7% of cited URLs came from domains with llms.txt, compared with 14.0% of all domains. In contrast, a table of contents, Article schema, five or more H2s, tables with headers, and a length of 1,000 words or more were all associated with more citations (1.5x to 1.7x). The study also found that in the online shop sample, Product schema (0.6x) and a visible updated date (0.7x) were both associated with fewer citations. The authors note that this is correlation, not causation, and it may reflect that product pages are cited by AI less often than article pages anyway. The study also shows how unreliable conclusions from small samples are: the effect of FAQ schema was −23% at 833 URLs and became +19% at 96,418 URLs.

Content can only be extracted in a structured way if AI can read the body content. In a retest published on October 19, Glenn Gabe used 3 test sites whose body content is rendered with JavaScript and asked five AI platforms to read the URLs. The results matched his first test in August 2025: ChatGPT, Claude, and Perplexity could still only read the navigation, footer, or cookie notice, and only Gemini and Copilot read the body content of the first two types of sites. The sample is only 3 sites, and the test covers the case where users give the AI a URL (which is not necessarily the same as search crawler behavior). But if a store’s product descriptions, reviews, FAQs, and size charts rely entirely on client-side JavaScript rendering, mainstream AI tools are likely unable to read this content.

Of course, if all the other basic work is already done, adding an llms.txt can be a small bonus.

Second, in two large GA4 datasets published this week, AI sources convert well but send far less traffic than Google organic search. The two datasets reached similar orders of magnitude:

• Marie Haynes: Across more than 145 million sessions on 100 websites over 12 months, sessions from ChatGPT were only 0.62% of those from Google organic search, and all LLMs combined were only 0.73% of Google organic. On the 55 websites that tracked conversions, the ChatGPT conversion rate was 13.8% (3.02% for Google organic search), but because the base is so small, Google organic search still drove 27 times as many total conversions as all LLMs combined. However, she did not disclose how she identified ChatGPT traffic or which industries the websites are in.
• SEO Works: Across 12 months of data from 95 GA4 properties, organic search traffic was 39 times AI assistant traffic. On the 63 comparable websites, the AI conversion rate was 7.18% and the organic search conversion rate was 6.08%, and every 100 organic search conversions corresponded to 3.2 AI conversions.
• Kevin Indig: An analysis of 12 websites found no reliable relationship between AI visibility and branded search or direct traffic (with only 12 sites, the sample is of limited representativeness).

Third, AI Overviews coverage of commercial queries has risen sharply, and content on third-party platforms can now influence AI answers. A Semrush study tracked 400 commercial keywords on US desktop across three industries (banking, ecommerce, and software), covering five types of modifiers: “alternatives,” “brand comparisons,” “best,” “price,” and “reviews.” From September 2025 to August 2026, the share of keywords that triggered AI Overviews rose from 45.75% to 88% (97.08% weighted by search volume). Ecommerce keywords rose from 32.62% to 85.11%, and review keywords rose from 30.14% to about 90%. The study has no click data, and once the 400 keywords are split across sub-industries and modifiers, each sample is small. But the trend is clear: when users search comparison and review terms, they increasingly see an AI summary first. Meanwhile, a Fudan University paper (the experiments were done from March to April 2026, and the platforms may have changed since) shows that after researchers used ordinary accounts to publish articles on fictional topics on frequently cited platforms such as Medium, YouTube, and Sohu, 8 of 10 AI search tools cited these fictional concepts within 7 days, and the fastest took only 1 hour. SEJ reported that Grok linked to these posts in 30 of 32 answers. Note that the paper tested fictional concepts, not real brand comparisons, but one can infer that posts other people publish on these platforms could also make their way into AI answers for brand comparison and review queries. Brands should regularly search their brand name in AI search to see which third-party posts it cites, set up a separate channel group for AI sources in GA4, and use real order data from their own store to decide how much effort to invest.

Agent shopping: Shopify stores declare Universal Cart capability by default

Shopify has been actively adopting AI shopping protocols such as UCP. As a Shopify Platinum Partner, Yiguo Tech also helps merchants adopt these capabilities on Shopify and optimize for GEO.

Last week’s roundup mentioned that Google launched Universal Cart in the US. This week, Search Engine Roundtable (October 23) reported that more and more users can see a cart icon at the top right of search results and “Add to cart” buttons on products. A Merchant Center help page states that merchant integration is rolling out gradually in the US, with Australia and Canada following next year. Google’s developer documentation also states that cart transfer is one-way and does not support two-way sync between Google and the merchant’s site.

For Shopify merchants, the more direct change is that the platform has probably already made a uniform declaration for all stores behind the scenes. On October 19, Slobodan Manic of No Hacks checked 60 Shopify stores. All 59 that he could access declared the dev.ucp.shopping.cart capability in their /.well-known/ucp file with identical wording, so he inferred that Shopify added it for all stores. But he also pointed out the limitations: the sample came only from Shopify Catalog, declaring a capability does not mean a store can already receive carts sent from Google, and Google has not published any usage data for Universal Cart.

Beyond the online cart, Shopify keeps adding features to /.well-known/ucp and MCP. The developer changelog from October 22 shows that stores with at least one retail location will declare store search and lookup capabilities in /.well-known/ucp, so that agents can find stores by name, distance, or whether a product is in stock. Shopify notes that this in-stock check “isn’t a stock count, a pickup promise, or a reservation.” In addition, from October 16, Checkout MCP and Cart MCP support passing in buyer consent information. If the agent does not pass it, Shopify applies the store’s default settings for the buyer’s country.

Other ecommerce platforms are building similar interfaces. On October 21, Cloudflare announced that it turned on WebMCP across nearly 100,000 store domains on Commerce.com (formerly BigCommerce). AI agents in the browser can call tools to search products and add them to the cart directly, customers complete checkout themselves, and merchants can opt out with one click. On the same day, Walmart published rules that let customers authorize each agent separately and set spending limits. By default, every purchase requires customer approval, and agents that break the rules will be blocked. On October 20, Google added features for small businesses to the Gemini app, and the third-party apps it can connect to include Shopify, but the announcement did not explain which read or write actions Gemini can perform on Shopify.

Shopify merchants should open /.well-known/ucp on their own store domain to confirm which agent capabilities it currently declares. Merchants with physical stores should check their store addresses and inventory locations. Merchants who sell to several countries must check the default marketing consent settings by country under “Customer privacy” in the Shopify admin, to avoid compliance problems caused by unsuitable defaults when agents place orders.

Google technical updates

Three updates directly affect day-to-day maintenance for online stores, mainly around URL conventions and Merchant Center:

• Brackets and hyphens in faceted URLs: On October 19, answering a question from Vanessa Fox on Bluesky, John Mueller said that ?filter[]=123 and ?filter%5B%5D=123 are not the same URL, because Section 2.2 of RFC 3986 defines brackets and the plus sign as reserved characters. But he did not say whether Google would consolidate the two forms. In addition, on October 23 the Search Central changelog recorded a wording change in the URL structure documentation, which now says hyphens “clearly signal a word boundary.” The recommendation to use hyphens and not underscores has not changed, and the edit only aligns the documentation with The Non-Canonical Cabinet video. Store owners should use one form consistently for filter and faceted URLs, and either encode them in all internal links, canonicals, and sitemaps or in none of them. Do not expect Google to merge them automatically.
• Merchant Center fast shipping days: Google added a table to the About fast shipping help page that lists how many days count as fast shipping in each country: 1 day in Japan and New Zealand, 2 days in India, 3 days in Australia, Canada, the UK, and the US, and 4 days in Brazil. The page states that the “Get it fast” filter in Google Search is currently only available in the US. Note that the eligibility section in the body of the help page lists only Australia, Canada, India, Japan, the UK, and the US, leaving out Brazil and New Zealand, which appear in the table, so the page is not yet internally consistent. Merchants who have turned on fast shipping should check, for each target country, that their promised delivery times match the shipping information on their site.
• Google Images does not support JPEG XL: Although Chrome supports decoding JPEG XL starting with version 155, the formats listed in the Google Images documentation are still BMP, GIF, JPEG, PNG, WebP, SVG, and AVIF. John Mueller said clearly that JPEG XL “is currently not supported.” Keep using WebP, AVIF, or JPEG for product images.

The rest are documentation changes and tests related to crawl control, AI interface display, and algorithms, listed below for reference:

• Generative AI controls in the documentation, and the limits of robots.txt: On October 21, Google added two sections to the Control what you share with Google Search documentation. They describe the existing robots meta tags, data-nosnippet, and X-Robots-Tag, as well as the Search generative AI control in Search Console, which opened globally on August 31, 2026 (no new features were added). The documentation states that this control “isn’t used as a ranking or inclusion signal affecting other parts of Search,” and that it does not affect AI training. To restrict training, use Google-Extended. On the same day, in episode 2 of The Non-Canonical Cabinet (as transcribed by Search Engine Roundtable), Gary Illyes and Cherry Prommawin noted that robots.txt applies to search crawlers and AI training crawlers, but “It doesn’t dictate what a system does with the data after it has already crawled it.” The parser only recognizes four fields, user-agent, allow, disallow, and sitemap, and ignores other lines. Non-English characters in paths should be percent-encoded.
• AI Overviews interface and AI Mode ad tests: On October 23, Brodie Clark noticed that citation cards in AI Overviews no longer show the original text of the source page and instead show a summary that Google generates for the query. Barry Schwartz also saw this for some queries, and Google has not commented. On October 20, some desktop AI Overviews were missing the “AI Overview” label, which came back on October 22, so it looks like a bug. We also catch up on an item from last week: according to Search Engine Roundtable, Google confirmed to Search Engine Land on October 16 that it is testing ads in AI Mode for users who have turned on Personal Intelligence (in March, Google said these users would not see ads). The help documentation states that ads are not based directly on Gmail or Google Photos content.
• Discover stale content filtering and Smart Bidding documentation: On October 21, Search Engine Journal reported on an arXiv paper describing the Supersession-Decay Filtering system, which uses two models to judge whether content has been superseded and whether its value has decayed. The abstract says the system has been fully deployed in Google Discover for two years and that user reports of “outdated content” fell by 54.9%. Google has not published anything about it. In addition, according to Search Engine Roundtable, Google Ads renamed its learning period help page to “About Smart Bidding learning” and rewrote it, mentioning a 7-day cap and which changes trigger a new learning period.

Other Shopify updates

Shopify shipped three admin updates this week. The first two directly affect Black Friday/Cyber Monday promotion scheduling and cross-border shipping costs. If what the storefront shows is out of sync with structured data, Merchant Center errors can follow:

• Rollouts now supports catalogs: From October 23, merchants can use Rollouts to schedule when catalogs are activated, deactivated, or switched, which lets them schedule product availability and prices by market and ship these changes together with theme and checkout changes in one release. Merchants who schedule price changes by market for Black Friday/Cyber Monday should spot-check, after each switch takes effect, that the prices and availability in the structured data on product pages in each market have updated.
• Managed Markets takes over international shipping: From October 24, Managed Markets can manage international shipping together with duty-inclusive pricing, with part of the shipping cost built into product prices and the rest charged at checkout. Shopify states that these shipping rates are set and updated by Managed Markets, and merchants cannot change them. After turning this on, make sure that the prices and shipping costs in each market’s Product structured data and product feed match the storefront.
• Checkout shows payment methods in a tiled layout: From October 22, checkout uses a tiled layout when certain conditions are met, such as having no more than four payment methods. Other setups still use the list layout.

Other industry news

First tests of the DeepSeek search API: On October 17, DeepSeek opened two APIs, Search and Fetch, which are built on its own search engine. On October 19, Suganthan Mohanadasan published initial tests based on 110 calls (the testing took one day). He found that authority scores appear to be assigned per hostname, so URLs on the same host get the same score. Fetch requests use an ordinary Firefox user-agent with no DeepSeek identifier, and they returned the content of 3 URLs that robots.txt disallows (the author could not confirm whether it read robots.txt). If this result holds, robots.txt or user-agent rules alone cannot stop these requests. But the test covered only one day and 110 calls, so more testing is needed to confirm it. I am also running a one-week tracking test of the DeepSeek search API and will publish a separate report once it is ready.

ChatGPT UTM follow-up: This week, Search Engine Land changed the headline of its report on the UTM issue we covered last week to “ChatGPT drop in UTM tracking was a bug.” According to Cedric Huesler of Adobe, the fix began rolling out in stages on October 15, and by 09:00 Pacific Time that day, tagged ChatGPT clicks had returned to 95% to 100% of the same period in the previous week. Historical data already recorded as direct traffic will not be restored, so keep this gap in mind when reading traffic reports for mid-October.

Linus’s notes

This week’s security incidents had different entry points. In Shopify’s case, app vendors’ admin systems and tools were breached. In UpdraftCentral’s case, connection keys leaked. In PHP’s case, the flaws were in the interpreter itself. But they expose the same weakness: merchants have little visibility into what third-party code, remote management connections, and configuration changes can do to their sites. I also worry that vibe coding will bring more plugins and apps to market without thorough security testing, but this week’s incidents do not prove that. So be careful when choosing plugins and apps, and prefer established products with a long maintenance record. On the other hand, AI is clearly getting better at finding vulnerabilities. In its post on this release, the PHP Foundation said that AI-assisted research means the PHP security team now receives far more reports than before, so plugins and runtimes will need to be updated more often. Choosing a hosted platform like Shopify saves some effort. If you choose WordPress, you must check and update plugins regularly yourself.

One useful method is to use the WordPress REST API (with Application Passwords) to check plugin versions across your sites in bulk and decide which ones need updating and which do not.

But a hosted platform is not risk-free either. This week, Shopify apps were injected with malicious code that hijacked checkout. In my view, the most dangerous thing about the Shopify app hijacking is how hard it is to detect. After customers were sent to a fake page to enter their card details, they were sent back to the real checkout page to complete payment, so merchants could hardly notice anything wrong from the orders in admin. Also, while Boost’s theme app extension was turned off, collection and search pages in Turbo stores were blank. This shows that when a third-party frontend script goes wrong, it not only threatens payment security but can also directly affect indexing if Googlebot crawls the pages during that time. My advice is to first make a clear list of which third parties can run code or send commands on your site. For Shopify stores, look at App embeds and the app code in the theme, and uninstall apps you do not use. For WordPress sites, besides the plugin list, check which remote management connections exist and disconnect the ones you do not use.

After reading this week’s empirical studies, my judgment is that store owners do not need to chase new concepts for GEO. Get Google organic search, server-side rendered HTML, and data checking right first. In the two GA4 samples from Marie Haynes and SEO Works, traffic from AI sources is far smaller than traffic from Google organic search, and the higher conversion rate does not make up for the gap in volume. Neither sample fully discloses its industry mix, so the results cannot be applied directly to every store, but the gap in scale is large. On the other hand, the share of commercial queries that trigger AI Overviews rose sharply over the past year, and posts on third-party platforms can quickly make their way into AI answers. So when users search brand comparisons and reviews, they see more and more AI summaries, and those summaries are also influenced by content on third-party platforms.

As for how to earn more citations, the SISTRIX study found no measurable effect of llms.txt. Basic structure, such as a table of contents, multiple H2s, and tables with headers, was associated with more citations instead. Glenn Gabe’s retest also shows that mainstream AI tools still cannot read body content rendered with client-side JavaScript. At the same time, the data itself has been unstable in recent weeks: rank trackers measured very different shares of fake results, AccuRanker changed its CTR model, and ChatGPT links lost their UTM tags for a while in mid-October, so it is easy to misread the numbers. So for now, I will focus GEO effort on Google’s AI Overviews and AI Mode first, and track real orders from AI channels separately in GA4, using that order data to decide how much to invest.

Finally, looking at the changes to platform rules and automated interfaces, my judgment is that the more a platform automates, the more likely a store is to run into problems when its storefront, structured data, ad landing pages, and privacy settings are out of sync. For example, if ChatGPT ads automatically send traffic to out-of-stock variant pages, discontinued product pages, or promotion pages with expired prices, they waste budget and lower conversions. Shopify’s Checkout MCP and Cart MCP apply the store’s default settings for the buyer’s country when an agent does not pass buyer consent information. And during Black Friday/Cyber Monday, after you schedule price changes with Rollouts or turn on Managed Markets to split shipping costs automatically, Merchant Center errors can follow if the Product structured data on product pages and the Merchant Center feed are not updated at the same time. So I recommend checking these default settings once a month. For the specific checks, see items 5 and 8 in “What this means for you” below.

What this means for you

1. Shopify stores should go through checkout in a private window and confirm that it ends on Shopify’s own checkout page. If you have used Swym, search the theme code for checkout-guard, but finding nothing there does not mean you were unaffected, so rely on the checkout test. Remove apps you do not use, and turn on two-step verification for Shopify and each app account.
2. Self-hosted WooCommerce or WordPress sites should have their hosting provider confirm that the PHP the site actually runs has been upgraded to 8.2.35, 8.3.36, 8.4.27, or 8.5.12, or to a patched build that includes the fix. Return 503 during downtime for patching.
3. Sites using UpdraftPlus should upgrade to 1.26.13 or 2.26.13, and not stop at 1.26.12. Then manually delete all UpdraftCentral connection keys and check for unfamiliar admins and plugins.
4. Stores that advertise on Meta should check, before November 20, how robots.txt handles Meta-ExternalAgent, Meta-WebIndexer, and Meta-ExternalAds, and look at their traffic in server logs.
5. Merchants running ChatGPT ads should decide before October 30 whether to turn off creative enhancements. If you keep it on, check the landing pages the system might send people to.
6. For any single-day sharp drop shown in rank trackers, check impressions, clicks, and average position in Search Console first, and then decide whether to change pages.
7. Turn off JavaScript and view your product pages to confirm that product descriptions, reviews, and FAQs are in the HTML. llms.txt is not a priority.
8. Shopify merchants should open /.well-known/ucp on their own store domain to see which agent capabilities it declares, and check the default marketing consent settings by country under “Customer privacy.”