PHP2Shell: Two Critical PHP Vulnerabilities. Is Your Website Affected?
October 22, 2026: PHP released emergency versions for two critical remote code execution vulnerabilities. They affect PHP-based websites, including WordPress.

September 23, 2026 · Daily Radar
On Tuesday, September 22, the same email from Google landed in the inboxes of a whole lot of sellers with a Merchant Center account. The subject line wasn't framed like an announcement, more like a notice: your products are now eligible for "native checkout." One of the sentences in the email went like this: your Shopify store has been linked to your Merchant Center account, so direct checkout on Google AI Mode and Gemini has been enabled. What followed was even more striking: eligible products have been included automatically, and there's nothing you need to set up.
There's nothing you need to set up. That sentence doesn't describe a feature being turned on; it describes a decision being made on the seller's behalf. Nobody filled out a form, nobody pressed a button. On top of that, Google's own help page still says today that this feature is available "for select merchants at this time," with an interest form for those who want to take part [A]. The Shopify documentation says something else: on eligible stores, direct checkout is enabled by default [A]. Two official documents don't say the same thing, and in the gap between them sits a checkout flow that went live without the seller knowing.
Google opened the ability to buy a product directly inside AI Mode and Gemini (UCP-powered native checkout) to a much wider group of sellers, and on Shopify stores the setting came switched on by itself. Today this applies only in the US, Canada, and Australia; so it doesn't currently affect a store selling within Turkey, but it directly affects a Shopify store that sells to those three countries. There's just one thing to do today: go to Sales channels > Agentic in the Shopify admin and see with your own eyes whether direct checkout is on or off.

Google's Universal Commerce Protocol (UCP) was announced as an open standard in January of this year [A]. The idea: when an AI assistant finds a product, instead of sending the user to the seller's site, it finishes the purchase inside that conversation. In February, the checkout piece went into a pilot with a limited number of US sellers: names like Nike, Sephora, Target, Ulta Beauty, Walmart, and Wayfair, plus Shopify stores like Fenty and Steve Madden [B].
In mid-September the scope widened, and on September 22 the notification emails went out [C]. What changed isn't really technical; it's the direction of the opt-in. It used to be that the seller came forward and said "count me in"; now the feature is considered on as soon as the platform and the Merchant Center account are linked. The seller's role has shifted from giving approval to turning it off if they don't want it.
Here's how the flow works: the user sees a product inside AI Mode or Gemini, taps the buy button next to the listing, and completes payment right there with the card and address saved in Google Wallet. They never visit the site.
The real issue here isn't commission. UCP itself is a free protocol, no per-transaction fee is taken, and the seller remains the seller of record: they collect the payment themselves, the customer data stays with them, and returns and after-sales are their responsibility [A]. As it stands, that's different from a model where a marketplace sits in the middle, and that's worth acknowledging.
What changes isn't ownership, it's contact. When a customer buys a product inside Google, they don't see your checkout page. Your cart upsell, your free-shipping threshold, your coupon field, the trust badges on your checkout step: all of it stays outside that flow. Those last three screens are exactly what people have spent years working on in website and conversion optimization. Now, for some orders, those three screens never open.
There's one more detail, and it gets missed: Google prohibits the price shown inside AI Mode from differing from the price on the site [C]. So there's no room for a maneuver like "I'll give a different price to people coming from Google." Whatever your feed says, that's it.
I think the side of this that will get talked about most isn't being talked about yet: data. The order comes to you, fine. But the browsing before that order, which products were viewed, what was compared: that part stays on Google's side. What you'll see in your Analytics is a conversion with no context.
I should add this too, because where everyone is getting excited, I have a reservation: right now this feature isn't a sales channel, it's a possibility. Google hasn't released a single number on how many orders the pilot generated from February to September. There's a list of big names and a protocol, but no volume. So the content saying "AI commerce has started, position yourself now" has no number to stand on either. The setting switching itself on is newsworthy; it's too early to say it changes your revenue today.
| Classic flow | Checkout inside AI Mode / Gemini | |
|---|---|---|
| Product discovery | Search → site | Assistant conversation |
| Checkout screen | Your site | Google surface, Google Pay |
| Seller of record | You | You |
| Customer data | With you | With you |
| In-cart upsell, coupon, shipping threshold | Works | Disabled |
| Pre-purchase behavior data | With you | With Google |
The one thing to do today: open Sales channels > Agentic in the Shopify admin and check the status of direct checkout. According to Shopify's own documentation, for per-channel control you first need to turn off the "Allow Shopify to manage for me" option, then flip the direct checkout toggle for the relevant channel. You don't need to buy anything, and it takes five minutes. I'm not saying turn it off; I'm saying make sure you've seen it.
Even though the checkout step moves inside Google, the decision is still made on the product page. I explained how to look at where your page is losing customers in the what to look for when getting a website built guide.
| News | Why people are talking about it | Who it concerns |
|---|---|---|
| "Dive deeper" test in Google Discover (September 18) | The button takes the reader not to the publisher's story but to a topic summary Google generates | Everyone who gets traffic from content, the GEO side |
| Links inside AI Overviews now lead to AI Mode | They look like ordinary links, but they go to Google's own interface, not to a web page | Teams measuring organic visibility |
| Store Ratings requirements clarified: at least 100 reviews, 3.5–5 star average | A new section was added to Merchant Center, and the threshold was spelled out for the first time | E-commerce brands running Google Ads |
| Instagram account requirement for Threads ads is going away | No more need to carry the same username; ads can be launched directly from Threads | The Meta ads side, rolling out gradually |
| Public Gemini Notebook pages opened up to spam | Spammers are injecting coupons and adult content into these pages | Enterprise AI teams setting up shared note workflows |
Not today. The feature is limited to the US, Canada, and Australia. The only group affected is stores based in Turkey that sell to those three countries.
No, UCP is a free protocol and there's no per-transaction fee. You keep paying your own payment provider's standard fee. An ad layer is expected to be added in the future, but there's no such fee today.
When you turn off direct checkout, your products keep being listed, and the user is sent to your site to buy. There's no statement from Google on whether turning it off affects rankings, and I can't say it doesn't either; there's no data on this.
As the checkout step slips out of your hands, the rest of the brand has to do more work: the product page, feed quality, the first screen a visitor to the site sees. Let's talk about what you need to fix on the web design and CRO side, or measure where you stand first.
October 22, 2026: PHP released emergency versions for two critical remote code execution vulnerabilities. They affect PHP-based websites, including WordPress.
I walk through the three ways to build a website, what to ask before you request a quote, and what drives the price. If you're building an online store, there are also legal steps you shouldn't skip.
We use cookies to improve the site and measure advertising performance. Analytics and advertising cookies run only if you accept them. Details are in our Privacy Policy and Data Protection Notice.