Good morning, what a week it’s been! It kicked off with the Google Cloud outage that hit banking apps and courier systems, then came a critical PHP security update that has had store owners scrambling, and then rounded off with Etsy tightening its rules on AI. The weekend can’t come fast enough. – Mike
In the basket today:
-
Critical PHP flaws put WooCommerce and Magento stores at risk (plus what you need to know and do)
-
Etsy tightens AI rules on listing photos and bans AI-written patterns
-
Vinted sellers are losing disputes despite hard evidence
-
Meta’s average ad price rises 14% as Q3 revenue reaches $64.6 billion
-
easyShop guarantees lowest peak shipping rates through Parcel2Go
-
Chinese ecommerce more than doubles its share of UK warehouse take-up
+Plus, in the reading list: how to tell whether your on-site chatbot is actually helping customers, and how The Works has fared since shutting its website.
SECURITY
1. Critical PHP flaws put WooCommerce and Magento stores at risk
TLDR: PHP has patched two critical flaws that let attackers run code on any PHP web server without logging in, including WooCommerce and Magento stores.
The fix sits in PHP on the server, so updating WooCommerce or Magento won’t help and maintenance mode offers no protection. It caps a rough week for the systems stores rely on, after Tuesday’s Google Cloud outage in London knocked out Revolut and other banking apps and sent DownDetector reports for Royal Mail and DPD spiking (more on that here).
Your Move: Check your store’s PHP version today (WooCommerce: Tools > Site Health > Info > Server) and get your host to confirm the patched release is installed.
The PHP flaw, in plain English
PHP is the software running behind the scenes on the server that hosts your website, and both WooCommerce and Magento depend on it. The flaw lets attackers run their own code on that server without needing a login.
-
Updating WooCommerce, Magento or your plugins won’t fix it. The fix has to be made by whoever runs your server, which is usually your hosting company.
-
Switching your shop to maintenance mode won’t protect it.
-
If your shop is hosted on WordPress.com, Pressable, WordPress VIP or WP Cloud, you’re already covered.
What to do
-
Email your hosting company today and ask: “Have you installed the PHP security updates released on 21st October?”.
-
If a developer or agency looks after your site, forward this to them.
-
If you’re told your site runs PHP 8.1 or older, ask for it to be upgraded, because those versions won’t get a fix.
-
On Magento, also ask your developer to install Adobe’s 13th October security update. You need both fixes.
-
To check for yourself in WordPress, go to Tools > Site Health > Info > Server. The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
FROM OUR SPONSOR
9 Plays e-Commerce Leaders Are Running to Protect Margin
On the surface, selling out sounds like a pretty good holiday problem to have. That’s the case until the costs add up.
CommerceIQ discovered that stockouts cost brands 140% more than baseline on Black Friday and 248% more on Cyber Monday.
Holiday growth can be difficult because more sales don’t always mean more profit. Margin quietly disappears across ad spend, discounts, inventory decisions, creator payouts, and returns that hit in January.
9 Plays to Defend Your Margin This Holiday Season looks at nine of those places, including:
-
Healthy ROAS hiding money-losing SKUs
-
Discounts on products shoppers aren’t price-comparing
-
Ad dollars going toward inventory at risk of stocking out
-
Creator payouts capped by first-order math
-
Returns that turn into refunds instead of exchanges
Plus learn four more ways to keep more of what you earn this Q4.
MARKETPLACES
2. Etsy tightens AI rules on listing photos and bans AI-written patterns
TLDR: Every Etsy listing now needs at least one unedited photo of the actual item, and AI-generated patterns, recipes and instructions are banned. POD listings come with caveats which still allow mockups.
AI editing is still fine on the other photos for lighting, cropping or backgrounds, but if a buyer opens a “not as described” case the seller may have to cover the refund. Etsy’s listing form now flags uploads it detects as AI-generated, with checks on existing listings to follow.
Your Move: Go through your best-selling Etsy listings this week and add a plain, unedited photo of the real item to any that lack one.
MARKETPLACES
3. Vinted sellers are losing disputes despite hard evidence
TLDR: Vinted sellers with photos, doorbell footage and purchase records are still losing disputes, and one has lost their account, the Guardian reports.
Consumer expert Martyn James says there’s “no real sense of appeal”, and the seller-run Sad Vinted Faces site says it has collected more than 6,400 cases. Vinted says all appeals go to human reviewers, but the Guardian’s cases show what it costs sellers when a decision goes against them.
Your Move: Photograph every item and its sealed parcel before dispatch, and keep proof of postage until the dispute window closes, a good rule of thumb for every marketplace.
FROM OUR SPONSOR
Still tracking income and expenses in a notebook or a spreadsheet?
Sage Sole Trader is free, cloud-based accounting built specifically for sole traders — track income and expenses, send invoices, and see exactly where you stand without touching a spreadsheet formula again.
For UK sellers it takes the guesswork out of self-assessment: it keeps your records HMRC-ready year-round, so tax season is a formality rather than a scramble through old receipts.
There’s no catch, it’s free to use, for as long as you use it.
MARKETING
4. Meta’s average ad price rises 14% as Q3 revenue reaches $64.6 billion
TLDR: Meta’s average price per ad rose 14% in Q3 while impressions grew 10%, as revenue reached $64.6bn.
That flips Q2, when impressions (14%) grew faster than prices (12%), so more of Meta’s growth now comes from charging advertisers more. Meta is guiding to $73bn to $76bn for Q4, up to 18% above Q3.
Your Move: Set a CPA ceiling on your Meta campaigns before Black Friday and pause any ad set that runs above it for three days.
LOGISTICS
5. easyShop guarantees lowest peak shipping rates through Parcel2Go
TLDR: easyShop, launched just over a week ago, has teamed up with Parcel2Go to guarantee sellers the lowest shipping prices until the final Christmas posting dates.
Sellers ship through Parcel2Go’s Smart Send with discounted rates from more than 15 couriers, and those who connect a store and send a first parcel before 30th November get £50 of shipping credit. It comes as Royal Mail’s peak surcharge for business accounts starts on 2nd November, more than two weeks earlier than last year.
Your Move: Compare your Royal Mail business rates from 2nd November against Smart Send quotes for your three most common parcel sizes before Black Friday.
LOGISTICS
6. Chinese ecommerce more than doubles its share of UK warehouse take-up
TLDR: Chinese ecommerce firms and their logistics partners took 17% of big-box UK warehouse take-up in Q3 2026, around 1.6m sq ft.
That’s more than double their 7% share across 2025 and H1 2026, and includes TikTok’s 250,400 sq ft Rugby fulfilment site. Knight Frank expects more stock to be held in the UK once low-value import relief goes (March 2029), so the same low-price competitors could soon be delivering just as fast as you.
Your Move: Rewrite the opening line of your top five listings to lead with what a cheap, fast rival can’t offer, like personalisation or proper UK-based aftercare.
📚 The Reading List
Curated deep dives, longer reads and analysis shaping the future of ecommerce and digital marketing.
I shut The Works website to focus on shops instead, and the High Street is paying off, reveals boss Gavin Peck
This is Money (5 min read)
The Works closed its website in March to focus on its 500-plus shops, and its boss says online customers have followed it into stores.
Move beyond default checkout: How shoppers prefer to pay in 2026
WooCommerce (8 min read)
A WooCommerce and Stripe survey of 1,400 shoppers found 63% of cart abandoners blamed checkout or payment problems, with failed transactions the top reason.
AI Shopping Metrics Considered
Practical Ecommerce (4 min read)
If your shop uses an AI assistant, chat counts and time on site show people using it, not whether it helped them buy, so this sets out what to track instead.