# E-commerce Published articles for E-commerce. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Dual-Stream LLM-Guided Reward Design for Reject-Inference-Aware Reinforcement Learning in E-Commerce Payment Fraud Detection DevFeed: [Dual-Stream LLM-Guided Reward Design for Reject-Inference-Aware Reinforcement Learning in E-Commerce Payment Fraud Detection]() Original publisher: [Read original article]() Author: Bo Qu, Zhurong Wang, Frank Zahradnik, Ming Ouyang Published: 2026-11-09T05:00:00Z Content type: article Language: en Sources: [arXiv: Machine Learning]() Topics: [Reinforcement learning](), [Machine learning](), [Large Language Model](), [Payment Fraud]() Tags: [cs-ai](), [cs-cl](), [cs-lg](), [detection](), [e-commerce](), [fraud](), [fraud-detection](), [learning](), [llm](), [payment](), [payment-fraud](), [reinforcement-learning](), [reward](), [stream]() ### AI overview The dual-stream reward design targets bias from fraud transactions blocked by a legacy system, which therefore lack fraud labels. A single LLM evolves a reward for the existing two-step REINFORCE blocking policy: one stream applies dollar-weighted precision to labeled transactions; the other scores legacy-blocked transactions by contrasting a newer gradient-boosted risk signal with the legacy scores used to block them. The LLM chooses among exposed evidence using evaluation feedback, and its reward code makes that choice auditable. On a held-out four-month out-of-time test, it exceeded the labeled-only agent's dollar-weighted precision by 4.7, 2.4, and 3.0 points at 80%, 85%, and 90% recall, respectively, and beat the production baseline by 6.8 points on average. The resulting policy adds no inference cost. ### Source excerpt arXiv:2611.08706v1 Announce Type: new Abstract: Production fraud-detection models learn from a censored slice of their own traffic: transactions a legacy system blocked never receive fraud labels, so models train on a biased, approved-only distribution. We extend LLM-guided reward design, the framework of Qu et al. (2025) in which an LLM evolves the reward of a two-step REINFORCE fraud-blocking policy, to attack this reject-inference problem inside the reward. A single LLM designs a dual-stream reward: stream 1 applies the standard dollar-weighted precision objective to labeled transactions; stream 2 scores legacy-blocked, unlabeled transactions by contrasting the newest gradient-boosted risk signal against the legacy scores that drove the original block. Rather than prescribe which signals matter, we expose a superset of evidence and let the LLM decide for itself which to use, guided by evaluation feedback alone; because it writes the reward as code, that choice is directly auditable. On a held-out four-month out-of-time test, the dual-stream agent beats the prior labeled-only agent at every target recall, by +4.7, +2.4 and +3.0 points of dollar-weighted precision at 80%, 85% and 90% recall, and the production baseline by +6.8 points on average. The resulting policy is architecturally identical to that of Qu et al. (2025) and adds no inference cost. ## Patching the Blind Spots: Reversible LLM Rule Overlay for Frozen Fraud Detectors DevFeed: [Patching the Blind Spots: Reversible LLM Rule Overlay for Frozen Fraud Detectors]() Original publisher: [Read original article]() Author: Bo Qu, Zhurong Wang, Frank Zahradnik, Ming Ouyang Published: 2026-11-09T05:00:00Z Content type: article Language: en Sources: [arXiv: Machine Learning]() Topics: [online-fraud-prevention](), [Large Language Model]() Tags: [benchmark](), [bias](), [classification](), [cs-ai](), [cs-cl](), [cs-lg](), [e-commerce](), [fraud](), [gradient-boosted-trees](), [llm](), [machine-learning](), [overlay](), [patching]() ### AI overview The paper proposes patching a frozen fraud detector with a reversible rule overlay instead of retraining it. LLMs generate candidate rules from features the model underweights according to SHAP; empirical screening and calibration turn supported rules into additive log-lift adjustments at the production cut-off. Because single-LLM gains varied and reversed across datasets, the authors average logits from three diverse backbones, trading peak gains for a bounded worst case. On a selection-biased e-commerce detector, continued training regressed, while the overlay averaged +2.26% recall at equal precision and +1.60% precision at equal recall across cut-offs spanning 30-57% precision and 23-63% recall. On seven designed public benchmark variants, it raised precision at equal recall on each and kept recall at equal precision near neutral. Amendments are readable predicates identifying the fraud patterns they cover. ### Source excerpt arXiv:2611.08714v1 Announce Type: new Abstract: In industrial tabular fraud classification, gradient-boosted trees remain state-of-the-art, but even a well-trained model has blind spots, and retraining the deployed model is not always safe. We propose a framework that patches such a model without modifying it: LLMs propose rules anchored on features the model underweights by SHAP, and the resulting noisy pool is screened for empirical support and calibrated into an additive, reversible log-lift overlay that runs at the production cut-off. Single-LLM benefit is high-variance and inverts between datasets, so we pool three diverse backbones by equal-weight logit averaging, trading peak gain for a bounded worst case. On a real-world e-commerce fraud detector trained on selection-biased data, continued training regresses even when carefully tuned, whereas the overlay gains on average +2.26% recall at equal precision ($\Delta$R@P) and +1.60% precision at equal recall ($\Delta$P@R) over production cut-offs spanning 30-57% precision and 23-63% recall. On a public benchmark of seven designed bias-shift variants it raises $\Delta$P@R on every variant and keeps $\Delta$R@P near neutral. Each amendment is a readable predicate naming the fraud pattern it covers. ## What Matters for LLM Persona Simulation: Signal Form in Cold-Start E-Commerce Advertising DevFeed: [What Matters for LLM Persona Simulation: Signal Form in Cold-Start E-Commerce Advertising]() Original publisher: [Read original article]() Author: Jiwoo Choi, In Ik Lee, Woo Sung Seo, Minho Lee, Yun Young Choi Published: 2026-11-09T05:00:00Z Content type: article Language: en Sources: [arXiv: Machine Learning]() Topics: [Large Language Model](), [Predictive AI]() Tags: [advertising](), [cs-ai](), [cs-lg](), [e-commerce](), [google-ads](), [llm](), [signal](), [simulation]() ### AI overview Using real Google Ads data across five demographic segments, the study finds that LLM-based cold-start ad performance estimates depend on how persona signals are presented. A minimal demographic anchor performed better on mean error than richer persona descriptions; relative qualitative banner-blindness cues substantially outperformed the tested quantitative anchors, and prompt phrasing also mattered. The reported method achieved MAE 24.9 and MAPE 26.1% on this campaign, with 51.3% lower MAE than the best tested non-LLM baseline and 77.3% lower than an LLM configuration using explicit CTR anchors. These results are from the tested campaign and configurations; the supplied abstract does not establish broader performance. ### Source excerpt arXiv:2611.08840v1 Announce Type: new Abstract: Estimating advertising performance in cold-start settings is challenging because historical logs are unavailable before launch. Large language models (LLMs) offer a potential alternative by simulating persona-conditioned user responses, but it remains unclear which design choices actually drive LLM-based persona simulation. Using real Google Ads e-commerce campaign data across five demographic segments, we identify three signal-form dimensions that affect simulation quality: (i) a demographic anchor without noisy rich attributes, (ii) a relative qualitative banner-blindness signal rather than quantitative anchors, and (iii) prompt phrasing. On this campaign, our method attains an MAE of 24.9 and a MAPE of 26.1%, a 51.3% lower MAE than the best tested non-LLM baseline and 77.3% lower than an LLM configuration using explicit CTR anchors. Systematic ablations show that minimal demographic descriptions achieve lower mean error than richer persona configurations, while relative qualitative cues substantially outperform the tested quantitative anchors. We additionally compare these configurations with direct-prior and rule-based baselines and with alternative LLM configurations. ## SLATE: A Large-Scale Benchmark for Long-Horizon API Selection in E-commerce Tool Use DevFeed: [SLATE: A Large-Scale Benchmark for Long-Horizon API Selection in E-commerce Tool Use]() Original publisher: [Read original article]() Author: Rongzhe Wei, Ge Shi, Min Cheng, Sarthak Ghosh, Vaibhav Gorde, Leman Akoglu, Pan Li, Na Zhang Published: 2026-11-04T05:00:00Z Content type: article Language: en Sources: [arXiv: Artificial Intelligence]() Topics: [gaia](), [Multi-step AI processes](), [Large Language Model]() Tags: [api](), [benchmark](), [cs-ai](), [cs-cl](), [e-commerce](), [evaluation](), [evaluation-harness](), [horizon](), [selection](), [simulator](), [tool-use]() ### AI overview SLATE tests whether agents can select and compose APIs across long procedures and a roughly 1,000-tool e-commerce library. It pairs hierarchical, tool-grounded procedures with a deterministic, context-aware simulator that returns recorded outputs for matching calls and defaults otherwise. Its automatic task-success metric checks whether every reference outcome is reached, allowing valid alternative trajectories. Across six open decision models and their underlying language models, sized 3B-12B parameters, the best completed only 5.0% of tasks. The abstract presents SLATE as a reproducible, challenging benchmark for enterprise tool use. ### Source excerpt arXiv:2611.03982v1 Announce Type: cross Abstract: Enterprises increasingly want LLM agents to automate standard operating procedures over their software stacks -- mapping each step of a procedure to the right call among thousands of internal APIs, without hand-authored step-to-API mappings. The core difficulty is API selection at scale: choosing and composing the correct tools over a long horizon, judged only by whether the overall task succeeds. Current tool-use benchmarks do not test this regime -- they expose only a handful of tools, evaluate single-step invocation, or grade multi-step behavior with subjective LLM-as-a-judge scores that penalize valid alternative trajectories. We introduce SLATE (Synthetic Large-scale API Toolkit for E-commerce), a large-scale benchmark that tests large-toolset, long-horizon API selection in a realistic enterprise domain. SLATE couples (i) queries decomposed into hierarchical, tool-grounded procedures over a ~1,000-tool e-commerce library, (ii) a deterministic, context-aware simulator that returns recorded outputs for matching calls and default responses otherwise, and (iii) an end-to-end task-success metric -- a task succeeds when it reaches every reference outcome -- that credits diverse-but-valid trajectories while remaining fully automatic and reproducible. Experiments with six open decision models and the language models they are built on, from 3B to 12B parameters, show that even the best model completes only 5.0% of the tasks, establishing SLATE as a challenging testbed for reliable enterprise tool use. We release SLATE, its simulator, and the evaluation harness at https://geshijoker.github.io/slate/ ## IntentGEO: Intent-aware Generative Engine Optimization for Recommendation DevFeed: [IntentGEO: Intent-aware Generative Engine Optimization for Recommendation]() Original publisher: [Read original article]() Author: Runlin Lei, Shiqi Zhang, Xiaokui Xiao, Zhewei Wei Published: 2026-11-04T05:00:00Z Content type: article Language: en Sources: [arXiv: Artificial Intelligence]() Topics: [recommendation systems](), [AI Chat]() Tags: [agentic](), [chatbots](), [cs-ai](), [cs-ir](), [doubao](), [e-commerce](), [generative-engine-optimization](), [geo](), [language-models](), [large-language-models](), [large-language-models-llms](), [llms](), [pipeline](), [prompt](), [prompt-drift](), [prompt-optimization](), [recommendation](), [recommendations](), [ugc](), [user-generated-content-ugc](), [user-intent](), [visibility]() ### AI overview IntentGEO evaluates how item visibility changes across user needs and decision stages, finding that existing GEO methods' gains vary by intent and that learning-based prompt optimization can underperform its handwritten seed. The authors trace this to prompt drift from recommendation instructions toward generic promotion. Their AMO method keeps recommendation instructions in a fixed core and learns appended strategies from citation feedback. Across four domains and ten intent states, AMO raises average citation-rank gain 35% over the strongest prior learning-based baseline and leads on nine states. The abstract also reports top gains in an agentic recommendation pipeline and, after separate adaptation, on Doubao. These results suggest evaluating GEO by user intent and anchoring prompt adaptation to recommendation goals. ### Source excerpt arXiv:2611.04225v1 Announce Type: cross Abstract: Large language models (LLMs) increasingly shape recommendations across chatbots, e-commerce, and user-generated content (UGC) platforms, creating demand for Generative Engine Optimization (GEO) to improve item visibility in generated responses. Existing GEO studies are mainly content-centric, optimizing visibility under general-purpose queries. However, a shared item description usually serves users with different needs and decision goals, resulting in its visibility gains being dependent on the request. To investigate how changing intent affects visibility, we formulate IntentGEO to evaluate shared rewrites across need specificity and decision progression. We revisit existing GEO methods and find that their visibility gains vary across user intents. More critically, learning-based prompt optimization can underperform its handwritten seed on average. Tracing these updates reveals prompt drift from explicit recommendation instructions toward generic promotional tactics. To address this drift, we propose AMO (Anchored Meta-Optimization), which preserves recommendation instructions in a fixed core while learning appended strategies from citation feedback. Across four domains and ten intent states, AMO improves average citation-rank gain by 35% over the strongest prior learning-based baseline and leads on nine states. Ablations show that learned additions improve on the fixed core alone and that AMO outperforms full-prompt optimization initialized from that core. It also achieves the highest gains in an agentic recommendation pipeline and, after separate adaptation, on Doubao, a commercially deployed, closed-source online assistant. These findings highlight user intent as a key dimension of GEO evaluation and support anchored adaptation across recommendation needs and decision stages. ## Ukraine's Drone Strikes Spur Hasty Russian Plans For Underground Data Centers DevFeed: [Ukraine's Drone Strikes Spur Hasty Russian Plans For Underground Data Centers]() Original publisher: [Read original article]() Author: BeauHD Published: 2026-11-04T03:30:00Z Content type: news Language: en Sources: [Slashdot]() Topics: [data centers](), [The Three Main Cloud Service Models](), [Network]() Tags: [ai](), [banking](), [cloud](), [cloud-computing](), [data-centers](), [drone](), [e-commerce](), [food-delivery](), [government](), [law](), [military](), [mining](), [payment](), [ride-hailing](), [russia](), [supercomputers](), [ukraine](), [war]() ### AI overview Russian companies and officials are considering ways to protect data center capacity after Ukrainian drone strikes disrupted services and forced Yandex to relocate its three main supercomputers, according to the excerpt. Rostelcom has discussed moving some centers underground with mining company Norilsk; a regional governor has proposed placing centers in open-pit coal mines with parks above as camouflage. A November 2 decree requires operators to reserve 10 percent of available space and capacity for possible government use, and permits a government commission, consulting the Federal Security Service, to authorize foreign data center use. The latter provision marks a shift from the Sovereign Internet Law's restrictions on foreign cloud infrastructure. The excerpt links these measures to vulnerabilities in Russia's centralized cloud system; it does not establish whether the proposed underground or mine-based facilities will be built. ### Source excerpt An anonymous reader quotes a report from Ars Technica: [S]tate-owned telecommunications company Rostelcom has raised the possibility of moving some Russian data centers underground in talks with the nickel and palladium mining company Norilsk, according to Russian newspaper Vedomosti. The industry publication Data Center Dynamics also pointed to a recent proposal by a Russian regional governor to build data centers within open-pit coal mines while planting green public parks above as camouflage. On November 2, Putin also signed a decree ordering Russian data center operators to set aside 10 percent of available space and capacity in case the Russian government requires it, according to independent Russian news publication Meduza. That may indicate growing Kremlin concerns about the vulnerability of Russian cloud computing infrastructure during its war with Ukraine. Putin's decree also allows a special Russian government commission to authorize use of foreign data centers in consultation with Russia's Federal Security Service. That marks a notable policy change because Putin and the Russian parliament previously enacted Russia's "Sovereign Internet Law," which has blocked Russian companies from using cloud computing infrastructure outside Russia's borders. Russia's push for a sovereign and increasingly closed Internet has resulted in a highly centralized system under a few Russian tech companies like Yandex. That hyper-centralized system has now proven vulnerable during wartime, as Ukrainian drone strikes on key Russian data centers created widespread disruptions for popular payment and digital banking apps, e-commerce platforms, video streaming services, and ride-hailing and food delivery apps, among others. Yandex has also been forced to relocate all three of its main supercomputers after Ukrainian drone strikes targeted the AI data centers where they were originally housed, Meduza reported. Read more of this story at Slashdot. ## Hackers behind $6.3bn Binance heist 'used malware and bogus job interviews' DevFeed: [Hackers behind $6.3bn Binance heist 'used malware and bogus job interviews']() Original publisher: [Read original article]() Author: Dan Milmo Global technology editor Published: 2026-11-03T19:00:23Z Content type: news Language: en Sources: [The Guardian | Technology]() Topics: [Binance](), [Malware](), [ai-assisted attacks](), [infection chain]() Tags: [ai](), [ai-artificial-intelligence](), [ai-tool](), [attack](), [binance](), [binance-business-cryptocurrencies-e-commerce-internet-technology-ai-artificial-intelligence-comput](), [business](), [computing](), [crypto](), [cryptocurrencies](), [cryptocurrency](), [e-commerce](), [exchange](), [hackers](), [heist](), [internet](), [interviews](), [job](), [june](), [led](), [malicious](), [malware](), [raid](), [recruitment](), [scam](), [software](), [technology](), [tool](), [world-news]() ### AI overview Binance says the $6.34bn wallet theft followed a months-long intrusion that combined malware, recruitment deception and access to an internal AI tool. An engineer first downloaded malware inadvertently in June; in September, another engineer was lured through fake job interviews into downloading malware. Binance says the attacker later used the compromised systems, stolen credentials and its AI tool to take control of two wallet developers' computers and trigger a malicious script on 29 October. The company reported that $2.85bn had been frozen or intercepted. The FBI attributed the hack to North Korea; Pyongyang denied responsibility. These details are from the supplied excerpt. ### Source excerpt Firm reveals details about how its cryptocurrency exchange was compromised, saying operation began in June The hackers behind the $6.3bn (GBP 4.7bn) Binance heist used bogus job interviews, malicious software and an internal AI tool, the company has revealed. The world's largest cryptocurrency exchange was compromised in an operation that began with an inadvertent download of malware in June, led to a recruitment scam in September and then a raid last week of "hot wallets" where billions of dollars worth of crypto-assets were taken. Continue reading... ## Binance battles to save its brand after record $6.3bn crypto hack DevFeed: [Binance battles to save its brand after record $6.3bn crypto hack]() Original publisher: [Read original article]() Author: Blake Montgomery Published: 2026-11-03T14:45:30Z Content type: news Language: en Sources: [The Guardian | Technology]() Topics: [Binance](), [Cryptography]() Tags: [ai](), [binance](), [brand](), [crypto](), [cryptocurrencies](), [cryptocurrencies-technology-binance-e-commerce-us-news](), [customers](), [e-commerce](), [exchange](), [fallout](), [funds](), [hack](), [security](), [technology](), [trading](), [us-news](), [whatsapp]() ### AI overview Binance said it would cover losses from a reported $6.3bn hack and that user funds were safe, while saying it had frozen about half the targeted funds. The article reports that attackers gained access through an engineer's infiltrated laptop, with Binance later citing additional breach points. The exchange processed $4.6bn in withdrawals and $1bn in deposits, a net outflow of about $3.6bn, as users faced fake compensation scams. Crypto customers generally lack government-backed deposit protection in the US, UK and Australia; in Australia, stolen assets may qualify for a tax loss claim with proof. The piece frames Binance's response as a test of trust for a company already burdened by former CEO Changpeng Zhao's 2023 guilty plea to violating US anti-money-laundering laws. ### Source excerpt World's largest crypto exchange faces fallout from angry customers, and Lula wins with WhatsApp This was originally published in TechScape, a newsletter about how technology shapes our lives. Sign up to receive it here This week in tech, we're discussing the fallout from the multibillion-dollar hack of Binance and the significance of Lula's political mobilization on WhatsApp. And if you'll be at Web Summit in Lisbon next week, drop me a line! I'll be there moderating panels on open-source AI and human agency in the age of AI agents. Tell us: have you been affected by the Binance hack? Polymarket temporarily suspends trading on international platform due to security incident How crypto hacking funds isolated North Korea's nuclear programme Ghost in the machine: how AI is haunting the search for the supernatural Computerized clairvoyance: psychics push back against AI-generated readings The staggering $446m Elon Musk has spent on the US midterms - visualized Billionaire tax: how a union leader's 'crazy' idea became the defining issue of California's midterms How tech became the villain of the US midterms The ultra-rich are spending one million dollars a day fighting California's proposed billionaire tax Continue reading... ## RecGroupMemory: Feedback-Aware Cohort Memory for E-Commerce Recommendation DevFeed: [RecGroupMemory: Feedback-Aware Cohort Memory for E-Commerce Recommendation]() Original publisher: [Read original article]() Author: Wendong Zhang, Weipeng Huang, Zhixin Ma, Bin Zhang, Dimin Wang Published: 2026-11-03T05:00:00Z Content type: article Language: en Sources: [arXiv: Artificial Intelligence]() Topics: [personalization](), [AI Chat]() Tags: [advice](), [commerce](), [comparisons](), [cs-ai](), [e-commerce](), [feedback](), [guidance](), [llm](), [memory](), [online](), [orchestration](), [planning](), [recommendation](), [revision](), [transaction](), [user](), [users](), [validation](), [values](), [workflow]() ### AI overview RecGroupMemory gives an orchestration LLM group-level user profiles and recommendation guidance, separating memory construction from later revision. It uses the previous day's outcome feedback to update decision guidance, with validation checks intended to keep selected source values unchanged. In an online comparison among Taobao users with low purchasing power selected by the business team, memory without feedback increased guided transaction users by 1.58% and memory with feedback by 1.78%, each relative to a no-memory baseline. The excerpt does not specify sample size or further experimental details. ### Source excerpt arXiv:2611.02453v1 Announce Type: new Abstract: Cohort memory can support LLM-based recommendation planning through group-level user profiles and advice. As outcome feedback becomes available, this guidance may need to be updated while preserving the underlying observations. We present RecGroupMemory, a workflow that provides this memory to an orchestration LLM and separates memory construction from feedback-based revision. It uses feedback from the previous day to revise decision guidance, while validation checks keep selected source values unchanged. Online comparisons were conducted among Taobao users with low purchasing power selected by the business team. Relative to a no-memory baseline, memory without feedback and memory with feedback showed increases of 1.58% and 1.78%, respectively, in the number of guided transaction users. ## Revolve Data Breach Impacts at Least 180,000 People DevFeed: [Revolve Data Breach Impacts at Least 180,000 People]() Original publisher: [Read original article]() Author: Ionut Arghire Published: 2026-11-02T13:35:21Z Content type: news Language: en Sources: [SecurityWeek]() Topics: [Security](), [data](), [online privacy]() Tags: [account](), [customers](), [cyberattack](), [cybersecurity-company](), [data-breach](), [data-breaches](), [e-commerce](), [fashion](), [fraud](), [hackers](), [identity-theft](), [incident-response](), [investigation](), [law-enforcement](), [massachusetts](), [notification](), [online-shopping](), [payment-card](), [remediation](), [revolve](), [securities-and-exchange-commission]() ### AI overview An incident on September 11 involved unauthorized access to Revolve systems, including its online shopping platform. Revolve's investigation found that attackers may have accessed and taken names, addresses, payment card numbers, and expiration dates saved to customer accounts. Notices filed in four states indicate at least 179,259 people were notified; the article says the company described the breach as affecting at least 180,000. Revolve contained and remediated the activity, notified law enforcement, and hired a cybersecurity company. It reported no service disruption and did not expect a material business impact. The company is not offering free identity theft or credit monitoring, and advises potentially affected customers to review account statements and watch for fraud or identity theft. It has not disclosed the total number affected, who was responsible, or how the breach occurred. ### Source excerpt Hackers accessed its online shopping platform and stole customers' personal and payment card information. The post Revolve Data Breach Impacts at Least 180,000 People appeared first on SecurityWeek. ## A gift to scammers: why you should probably keep your birthday a secret DevFeed: [A gift to scammers: why you should probably keep your birthday a secret]() Original publisher: [Read original article]() Author: Shane Hickey Published: 2026-11-01T07:00:05Z Content type: article Language: en Sources: [The Guardian | Technology]() Topics: [online privacy](), [pii](), [Social engineering](), [Cybercrime]() Tags: [account](), [bank](), [birthday](), [consumer-affairs](), [cybercrime](), [data-and-computer-security](), [e-commerce](), [fake](), [fraud](), [hacking](), [identity](), [identity-fraud](), [identity-theft](), [information](), [leaving](), [money](), [money-identity-fraud-scams-consumer-affairs-cybercrime-hacking-online-shopping-technology-e-commerce](), [online](), [online-shopping](), [retail-industry](), [scams](), [secret](), [technology]() ### AI overview A date of birth can help scammers build a convincing identity profile when combined with names, contact details and other leaked or public information. The article advises leaving birthday fields blank on low-risk retail and other nonessential accounts; if a site requires one, using a consistent fake date, and considering a separate shopping email address. Keep your real name and DOB for services that verify identity against official records, such as banks, lenders and government agencies. Be wary of unexpected callers or messages even when they know personal details. The article notes that age-restricted purchases may require age verification. ### Source excerpt Using a fake DOB or leaving the field blank when making an online account can offer protection from identity theft You get a call from your bank saying there has been suspicious activity on your account. They read out your name, address and date of birth so you are happy it is a legitimate caller. But you are talking to criminals who have used your date of birth as part of a web of verifying information to convince you they are someone else. Continue reading... ## How to Optimize AI-Generated Images for Faster Websites DevFeed: [How to Optimize AI-Generated Images for Faster Websites]() Original publisher: [Read original article]() Author: Asjad SEO Published: 2026-10-31T05:40:42Z Content type: tutorial Language: en Sources: [SitePoint]() Topics: [Page Speed Optimization](), [Image](), [Web Development](), [Responsive Design](), [performance-optimization](), [Web Accessibility (a11y)](), [Tool]() Tags: [accessibility](), [ai](), [ai-generated-images](), [ai-image-generation](), [alt-text](), [animation](), [artifacts](), [assets](), [audit](), [automate](), [automation](), [bandwidth](), [blog](), [blog-posts](), [browser](), [e-commerce](), [faster](), [how-to](), [images](), [meta](), [optimize](), [websites]() ### AI overview The article recommends treating image optimization as part of development: size assets for their actual layouts, preserve a high-quality master, compare AVIF, WebP and JPEG by file size and appearance, and automate responsive variants with Sharp. Its Node.js example creates four widths in AVIF and WebP, with quality settings offered only as starting points. Use `srcset` and accurate `sizes` so browsers choose suitable files; `picture` can provide format fallbacks or alternate crops. Set width and height to reserve space, lazy-load below-the-fold images, and prioritize a main hero image when it drives LCP. Review alt text and project metadata needs before stripping metadata. The article advises checking browser-selected files in DevTools and auditing with Lighthouse or PageSpeed Insights; results depend on layout, image content, encoding and quality requirements. ### Source excerpt null Continue reading How to Optimize AI-Generated Images for Faster Websites on SitePoint. ## CVE-2026-62989 - Shopper: missing variant-delete authorization permits destructive single and bulk actions DevFeed: [CVE-2026-62989 - Shopper: missing variant-delete authorization permits destructive single and bulk actions]() Original publisher: [Read original article]() Author: CVEFEED.io; github.com Published: 2026-10-30T21:17:15Z Content type: news Language: en Sources: [Latest High/Critical Vulnerabilitiy Feed]() Topics: [Authorization](), [permission](), [CRUD]() Tags: [2026](), [actions](), [admin](), [authorization](), [checkout](), [commerce](), [component](), [cve](), [cve-2026-62989](), [delete](), [e-commerce](), [fixed](), [headless](), [issue](), [multiple](), [product](), [products](), [server](), [staff](), [version]() ### AI overview Before Shopper 2.10.0, the Variants Livewire component exposed single and bulk deletion actions without checking the dedicated `delete_product_variants` permission on the server. An authenticated staff user with `edit_products` could access a product edit page and invoke these actions to permanently delete variants, potentially disrupting the sellable catalogue and storefront pages, cart, and checkout. The issue is fixed in version 2.10.0. ### Source excerpt CVE ID :CVE-2026-62989 Published : Oct. 30, 2026, 9:17 p.m. | 37 minutes ago Description :Shopper is a Headless e-commerce Admin Panel. Prior to 2.10.0, the Variants Livewire component in `packages/admin/src/Livewire/Components/Products/Form/Variants.php` exposes `DeleteAction` and `DeleteBulkAction` without server-side authorization. An authenticated staff user with `edit_products` can access `/shopper/products/{id}/edit` and obtain the signed component state even without `delete_product_variants`. The `callTableAction` and `callTableBulkAction` paths then permanently delete individual or multiple variants without checking that dedicated permission. For variant products, this can destroy the sellable catalogue and disrupt storefront product pages, cart, and checkout. This issue is fixed in version 2.10.0. Severity: 8.1 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more... ## A Deep Learning Framework for Quantile Demand Forecasting in E-commerce with Doubly Censored Data DevFeed: [A Deep Learning Framework for Quantile Demand Forecasting in E-commerce with Doubly Censored Data]() Original publisher: [Read original article]() Author: Ziwen Ye, Jiawen Wei, Teng Song, Chen Chen, Guangrui Ma Published: 2026-10-30T04:00:00Z Content type: article Language: en Sources: [arXiv: Machine Learning]() Topics: [Deep learning](), [Machine learning](), [Artificial Intelligence]() Tags: [cs-lg](), [deep-learning](), [demand-forecasting](), [e-commerce](), [inventory](), [quantile](), [retail](), [uncertainty](), [uncertainty-quantification]() ### AI overview The paper proposes a deep learning framework to estimate demand quantiles from doubly censored retail sales, where stock limits can suppress recorded sales and promotions can inflate them relative to underlying demand. It also introduces a tailored evaluation metric, reports theoretical guarantees and correlation with an oracle calibration measure, and says the estimator outperforms existing baselines. Inventory simulations and real-world applications are reported as evidence of practical utility. The supplied text is an abstract and does not specify the method, experiments, or size of the reported gains. ### Source excerpt arXiv:2610.40138v1 Announce Type: new Abstract: In recent years, a growing number of online retail companies have embraced deep learning models for demand forecasting, leveraging their scalability in processing large-scale datasets. Accurate demand forecasts enable improved planning and allow operational flexibility to adjust sales accordingly. Moreover, quantile estimation has gained widespread application as it offers valuable uncertainty quantification, thereby enhancing the robustness of decision-making processes. However, limited research has addressed the effective quantification of uncertainty when target labels are ambiguous. In retail, actual sales can be capped by stock and boosted by temporary promotions, whereas the target is underlying demand. Such scenarios are characterized by double censoring and no deep-learning pipeline yet exists for such data. In this paper, we introduce a straightforward framework for learning quantiles from doubly-censored observations and propose a tailored evaluation metric. Our approach is supported by theoretical guarantees, and we empirically demonstrate that our metric correlates well with the oracle calibration measure. Experimental results show that our estimator surpasses existing baselines. Finally, inventory simulations and real-world applications confirm the practical utility of our method in retail operations. ## Reinforcement Learning Under Runtime Confounding: Policy Learning and Off-Policy Evaluation DevFeed: [Reinforcement Learning Under Runtime Confounding: Policy Learning and Off-Policy Evaluation]() Original publisher: [Read original article]() Author: Raphael Kim, Michele Santacatterina, Ramin Zabih, Keith Barnatchez Published: 2026-10-30T04:00:00Z Content type: article Language: en Sources: [arXiv: Machine Learning]() Topics: [Reinforcement learning](), [Machine learning]() Tags: [algorithms](), [cs-lg](), [data](), [diagnostics](), [e-commerce](), [evaluation](), [healthcare](), [policy](), [reinforcement-learning](), [robotics](), [runtime](), [stat-me](), [stat-ml]() ### AI overview Runtime confounding arises when logged data include decision-driving variables that are unavailable at deployment. In reinforcement learning, this missing knowledge can affect later states, observations, and action assignments, creating bias over time. The paper says it develops policy-learning algorithms for this setting, semi-parametric efficient procedures for off-policy estimation, and diagnostics to assess the cost of runtime confounding. The supplied text is an abstract and does not provide algorithmic details or empirical results. ### Source excerpt arXiv:2610.40056v1 Announce Type: cross Abstract: Reinforcement learning (RL) is increasingly used to train robust, adaptable systems across healthcare, e-commerce, and robotics. In these settings, legal, ethical, or logistical concerns may preclude certain key variables that drive decisions from being collected during deployment time. This gives rise to a setting known as runtime confounding: the logged data hold full observability, but deployment time lacks knowledge of certain variables, known as runtime confounders. Unlike single timepoint and non-adaptive settings, runtime confounding under reinforcement learning has the potential to propagate over time, as earlier decisions affect future states, observations, and action assignments, leading to biased learning. We address these problems with three contributions: we (1) develop policy learning algorithms under runtime-confounding, (2) develop semi-parametric efficient off-policy estimation procedures, and (3) provide diagnostics for understanding the price of runtime confounding. ## KARMA: Training-Free Knowledge-Atomic Harness Evolution for Industrial Advertising Agents DevFeed: [KARMA: Training-Free Knowledge-Atomic Harness Evolution for Industrial Advertising Agents]() Original publisher: [Read original article]() Author: Xinhua Miao, Yuanzhen Rong, Weiru Zhang, Xiaoyi Zeng Published: 2026-10-30T04:00:00Z Content type: article Language: en Sources: [arXiv: Artificial Intelligence]() Topics: [Agent Harness](), [llm-reasoning]() Tags: [abstract](), [advertising](), [agents](), [arxiv](), [atomic](), [candidate](), [cases](), [code](), [commerce](), [cs-ai](), [domain](), [domain-model](), [domains](), [e-commerce](), [evolution](), [failed](), [free](), [harness](), [industrial](), [knowledge](), [training]() ### AI overview KARMA adapts advertising agents by editing six typed knowledge modules while keeping model weights and executable harness code fixed. A deterministic Trace Verifier links errors to candidate modules; a Critic compares successful and failed trajectories to guide a constrained Evolver. A validation gate keeps an edit only when its measured gain meets a threshold, otherwise restoring the prior state. Across three LLM families and 18 domain-model settings, the reported average hold-out score rose from 30.19 to 39.15 (+8.96 points, 29.7%). Removing either successful or failed trajectories more than halved the average gain. Knowledge transferred across domains without further adaptation, with an average hold-out gain of 8.54 points across source-target pairs. The abstract describes evaluation on cases sampled from roughly half a million operation logs across six e-commerce domains; it does not provide further methodological or metric details. ### Source excerpt arXiv:2610.39884v1 Announce Type: new Abstract: Industrial advertising agents must continually adapt their decision knowledge to changing product offerings, traffic patterns, and operating policies. We present KARMA (Knowledge-Atomic, Regression-Gated Modular Adaptation), a training-free framework that evolves six typed knowledge modules while keeping model weights and executable harness code frozen. During our evolution, a deterministic Trace Verifier maps observed errors to candidate modules, and a Critic compares successful and failed trajectories to guide a tool-constrained Evolver. The Evolver applies atomic knowledge edits, which a fixed validation gate retains only when their measured gain reaches a threshold; otherwise, the previous knowledge state is restored. We evaluate KARMA with three LLM families on cases sampled from a corpus of approximately half a million real-world operation logs across six e-commerce domains. Across 18 domain--model settings, KARMA raises the average hold-out score from 30.19 to 39.15 (+8.96 points, +29.7%). Ablations show that removing either successful or failed trajectories more than halves the average hold-out gain. Evolved knowledge also transfers across domains without further adaptation, yielding an average hold-out gain of 8.54 points across all source--target pairs. By linking retained patches to their diagnostic evidence and validation outcomes, KARMA supports inspectable, reversible knowledge adaptation for agents in Web marketplaces. ## CVE-2026-56828 - Shopper: read-only team permissions allow administrator creation and permission escalation DevFeed: [CVE-2026-56828 - Shopper: read-only team permissions allow administrator creation and permission escalation]() Original publisher: [Read original article]() Author: CVEFEED.io; github.com Published: 2026-10-28T16:17:08Z Content type: news Language: en Sources: [Latest High/Critical Vulnerabilitiy Feed]() Topics: [Authorization](), [permission](), [rbac]() Tags: [2026](), [admin](), [administrator](), [authorization](), [cve](), [cve-2026-56828](), [e-commerce](), [permission](), [permissions](), [privilege-escalation](), [rbac](), [roles](), [team](), [users](), [version]() ### AI overview Shopper versions 2.8.0 up to 2.8.1 have authorization gaps in three Livewire team-management components. A staff member with `view_users` and `access_dashboard` can grant or remove permissions, create a pre-verified administrator by selecting the admin role and setting a password, or delete removable roles, which can also revoke access for assigned users. The permission controls check `view_users` where `access_setting` is required, and role deletion lacks action-level authorization. The issue is fixed in version 2.8.1. The source reports severity 8.8 (HIGH); it lists no affected products. ### Source excerpt CVE ID :CVE-2026-56828 Published : Oct. 28, 2026, 4:17 p.m. | 30 minutes ago Description :Shopper is a Headless e-commerce Admin Panel. From 2.8.0 until 2.8.1, three Shopper Livewire admin components retain authorization gaps after the earlier team-settings authorization fix. A staff member with only `view_users` and `access_dashboard` can mutate permissions, create an administrator, or delete roles. In `packages/admin/src/Livewire/Components/Settings/Team/Permissions.php`, `togglePermission` and `removePermission` authorize `view_users` rather than the stronger `access_setting` permission; `packages/admin/resources/views/livewire/components/settings/team/permissions.blade.php` exposes permission IDs in `wire:click` handlers. The attacker can grant arbitrary permissions to the bound role, including `access_setting` on the attacker's own role, or delete permission definitions. In `packages/admin/src/Livewire/SlideOvers/CreateTeamMember.php`, `mount()` and `store()` also accept `view_users`, and the client-selected `role_id` can identify the admin role, allowing creation of a pre-verified administrator with an attacker-chosen password. In `packages/admin/src/Livewire/Pages/Settings/Team/RolePermission.php`, `deleteAction` has no action authorization and is only conditioned on `can_be_removed`, while page access requires `view_users`. Deleting a removable role removes access for assigned users, enabling RBAC denial of service as well as privilege escalation. This issue is fixed in version 2.8.1. Severity: 8.8 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more... ## HiMA-Ecom: A Long-Horizon Memory Benchmark for Hierarchical Multi-Agent E-commerce Assistants DevFeed: [HiMA-Ecom: A Long-Horizon Memory Benchmark for Hierarchical Multi-Agent E-commerce Assistants]() Original publisher: [Read original article]() Author: Junxing Hu, Ai Han, Haolan Zhan, Pu Wei, Zhiqian Zhang, Yuhang Guo, Jiawei Lu, Zhen Chen, Haoran Li, Zicheng Zhang, Ling Li Published: 2026-10-28T04:00:00Z Content type: article Language: en Sources: [arXiv: Artificial Intelligence]() Topics: [hierarchical agent systems](), [grpo](), [Multi Agent Systems](), [AI Context Management](), [Reinforcement learning](), [Benchmark](), [Fine-tuning]() Tags: [agentic-systems](), [benchmark](), [cs-ai](), [deepseek-r1](), [deepseek-v3](), [e-commerce](), [efficiency](), [long-context](), [memory](), [multi-agent](), [open-source](), [optimization](), [reinforcement-learning](), [sampling]() ### AI overview HiMA-Ecom provides 22.8K e-commerce assistant instances, including 17.7K with memory entries in context, and pairs agent-specific supervised fine-tuning data with system-level supervision for multi-agent reinforcement learning. Its HiMA-R1 method uses VR-GRPO to sample along an initial trajectory, update agents with the greatest reward variance, and reward shorter trajectories; a memory evolution mechanism uses GRPO rewards as signals for what to retain in context. The abstract reports that agents based on 3B and 7B open-source models match DeepSeek-R1 and exceed DeepSeek-V3 by an average of 6.0 points, while reward-driven memory cuts convergence update steps by roughly 55%. These findings are reported for the benchmark and methods described in the abstract. ### Source excerpt arXiv:2506.19846v3 Announce Type: replace Abstract: Long-horizon agentic systems become long-context systems by accumulation rather than through a single long document, since every step reassembles a prompt from role instructions, tool and sub-agent descriptions, recalled memories, dialogue history, and previous tool outputs, separately for every agent. This paper studies how such accumulated context can be trained, evaluated, and managed in hierarchical multi-agent assistants. We present HiMA-Ecom, a hierarchical multi-agent benchmark for e-commerce assistants with 22.8K instances, of which 17.7K carry memory entries in context, pairing agent-specific supervised fine-tuning data with system-level supervision for end-to-end multi-agent reinforcement learning. Building upon it, HiMA-R1 keeps the context budget of a trajectory under control through Variance-Reduction Group Relative Policy Optimization (VR-GRPO), which samples along an initial trajectory so that sampling cost grows additively with trajectory length and updates the agents with the largest reward variance, together with an efficiency reward on trajectory length and a memory evolution mechanism that repurposes GRPO rewards as cost-free signals for what stays in context. Agents built upon 3B and 7B open-source models match DeepSeek-R1 and surpass DeepSeek-V3 by 6.0 points on average, while reward-driven memory reduces the update steps needed for convergence by roughly 55%. ## MAREval: A Multi-Agent Framework for Evaluating Natural Language Recommendation Explanations DevFeed: [MAREval: A Multi-Agent Framework for Evaluating Natural Language Recommendation Explanations]() Original publisher: [Read original article]() Author: Reza Yousefi Maragheh, Jayesh Uddhav Kudase, Aysenur Inan, Ramin Giahi, Kai Zhao, Parth Parikh, Jianpeng Xu, Jason Cho, Evren Korpeoglu, Sushant Kumar Published: 2026-10-28T04:00:00Z Content type: article Language: en Sources: [arXiv: Artificial Intelligence]() Topics: [Multi Agent Systems](), [AI Agent](), [Large Language Model](), [ai alignment](), [Artificial Intelligence]() Tags: [a-b-testing](), [agent-framework](), [alignment](), [annotation](), [cs-ai](), [cs-ir](), [e-commerce](), [engagement](), [evaluation](), [evaluations](), [experiments](), [human-judgment](), [language-models](), [llms](), [monte-carlo](), [multi-agent](), [natural-language](), [online](), [quality](), [real-world](), [recommendation](), [recommender-systems]() ### AI overview MAREval evaluates natural-language recommendation explanations with a multi-agent process intended to improve consistency and agreement with human judgment. A planner uses Chain of Debate prompting to coordinate roles and set evaluation plans, a moderator mitigates prompt drift, and an arbitrator aggregates results across rounds; Monte Carlo sampling is also used to improve robustness. The supplied abstract reports stronger alignment with human judgments than single- and multi-agent baselines on a public benchmark and proprietary recommendation data, plus lower variability across repeated trials. It also reports meeting production thresholds in a large human-annotation gate and statistically significant engagement and revenue improvements in online A/B tests. The excerpt does not provide metrics or implementation details. ### Source excerpt arXiv:2610.36389v1 Announce Type: new Abstract: Evaluating natural language explanations in recommender systems is essential for fostering user trust, transparency, and engagement. However, existing evaluation approaches like human evaluations, while accurate, are resource-intensive and impractical at the scale required by modern recommendation platforms. Also, automated methods using single-agent LLMs suffer from prompt sensitivity and inconsistent outputs. To address these challenges, we propose MAREval, a structured multi-agent framework for evaluating recommendation explanations using large language models. MAREval orchestrates (i) a planner agent that uses a novel Chain of Debate (CoD) prompting strategy to coordinate agent roles and enforce logically consistent evaluation plans; (ii) a moderator agent that regulates discussions by mitigating prompt drift; and (iii) an arbitrator agent that aggregates outputs from multiple evaluation rounds and (iv) a Monte Carlo sampling method, improving robustness and alignment with human judgment. We conduct comprehensive evaluations on both public (TopicalChat) and proprietary recommendation datasets, demonstrating that MAREval outperforms state-of-the-art baselines. Comprehensive experiments on a public benchmark and a proprietary e-commerce dataset show that MAREval improves alignment with human judgments over strong singleand multi-agent baselines. Stability analyses indicate substantially lower variability across repeated trials. In a large human-annotation gate, MAREval meets production quality thresholds where prior evaluators fall short, and online A/B testing demonstrates statistically significant improvements in engagement and revenue metrics. These results establish MAREval as a scalable and reliable solution for human-aligned evaluation of recommendation explanations in real-world systems ## PailitaoMMSearch2.0 Technical Report: Scaling Generative Retrieval to Unified End-to-End Multimodal Search DevFeed: [PailitaoMMSearch2.0 Technical Report: Scaling Generative Retrieval to Unified End-to-End Multimodal Search]() Original publisher: [Read original article]() Author: Xiaohan Ye, Zihan Gong, Jingqian Zhao, Lianyu Du, Yunmeng Shu, Xu Chen, Zesheng Zhou, Renchun You, Bocheng Chen, Jinsong Lan, Haihong Tang, Bo Zheng Published: 2026-10-28T04:00:00Z Content type: article Language: en Sources: [arXiv: Artificial Intelligence]() Topics: [AI-driven information retrieval](), [Advanced AI workflows](), [Reinforcement learning](), [Fine-tuning]() Tags: [applications](), [arxiv](), [beam](), [budget](), [candidate](), [capacity](), [commerce](), [continuous](), [control](), [cost](), [cs-ai](), [cs-ir](), [data](), [dimensions](), [e-commerce](), [generative](), [multimodal](), [report](), [retrieval](), [scaling](), [search](), [technical]() ### AI overview PailitaoMMSearch generates product Semantic IDs directly from query images and free-form instructions to support varied shopping intents and deployment constraints in one multimodal search system. It scales data through reusable workflows for cold-start synthesis, quality control, real-traffic refinement, and ongoing production; scales intent capabilities through continual pre-training, mixed-budget supervised fine-tuning, and reinforcement learning with intent-balanced optimization and Sample-Beam rollouts; and offers quality-cost operating points by varying model capacity and reasoning budget. Deployed on Taobao Pailitao, it showed statistically significant online A/B test gains of 17.90% in item page views, 27.04% in transactions, and 8.94% in gross merchandise value. ### Source excerpt arXiv:2610.36958v1 Announce Type: cross Abstract: Generative retrieval models have been increasingly adopted in search and recommendation systems. However, industrial generative retrieval models are commonly specialized to a fixed online scenario: they learn from scenario-specific interactions, support a narrow set of query forms and retrieval objectives. We study how to remove these couplings and build a unified end-to-end multimodal search system for open-ended image--text queries, heterogeneous shopping intents, and online scenarios with different resource constraints. We present \textbf{PailitaoMMSearch}, which directly generates product Semantic IDs from a raw query image and free-form instruction and scales along three dimensions. \textbf{Data scaling} uses a reusable toolset that can be composed into intent- and lifecycle-specific workflows for cold-start synthesis, quality control, real-traffic refinement, and continuous data production. \textbf{Intent scaling} progressively equips one model with e-commerce product knowledge, multiple retrieval relations, and adjustable reasoning budgets through continual pre-training (CPT), mixed-budget supervised fine-tuning (SFT), and unified reinforcement learning (RL). The RL stage combines intent-balanced optimization and Sample--Beam rollouts aligned with multi-candidate serving. \textbf{Scenario scaling} exposes quality--cost operating points across model capacity and reasoning budget. The system is deployed in multimodal search applications on Taobao Pailitao. A controlled online A/B test reports statistically significant improvements, including item page views $\textbf{+17.90\%}$, transactions $\textbf{+27.04\%}$, and gross merchandise value $\textbf{+8.94\%}$. ## Hackers hijack Convertr analytics script to steal payment card data DevFeed: [Hackers hijack Convertr analytics script to steal payment card data]() Original publisher: [Read original article]() Author: Bill Toulas Published: 2026-10-27T20:57:25Z Content type: news Language: en Sources: [BleepingComputer]() Topics: [Payment Fraud](), [Software]() Tags: [2026](), [analytics](), [api](), [bank](), [brazil](), [cache](), [caching](), [campaign](), [card](), [checkout](), [cleanup](), [commerce](), [computer-help](), [computer-security](), [computers](), [credit-card](), [credit-card-stealer](), [data](), [e-commerce](), [hackers](), [hijack](), [infosec](), [infosec-computer-security](), [linux](), [mac](), [magecart](), [malware](), [malware-removal](), [payment](), [payment-card](), [platform](), [script](), [security](), [skimmer](), [spyware](), [supply-chain](), [supply-chain-attack](), [support](), [tech-support](), [technical-support](), [virus](), [virus-removal](), [windows]() ### AI overview Sansec reports that attackers injected a payment skimmer into Convertr's self-hosted Plausible analytics tracker, which loads on checkout pages across its merchant platform. The code collected card numbers, expiration dates, CVVs, cardholder names and CPF taxpayer IDs; by October 26, it had been tailored to Convertr's payment API field names. Sansec suspects, but has not confirmed, exploitation of CVE-2026-8467 in an outdated Plausible Community Edition installation. Convertr removed the skimmer, upgraded Plausible and said it was notifying affected merchants and payment providers. Sansec warns browser caching could keep the script active for up to 24 hours after cleanup. It advises people who paid by card since October 24 on Brazilian stores with "checkout.convertr" in the checkout address to contact their bank and block the card, and to clear their browser cache before ordering again. ### Source excerpt A credit card skimming group reportedly compromised a shared analytics script used by e-commerce platform Convertr to steal shoppers' payment data during checkout. [...] ## Hackers Infect 953 Online Stores With Scanner-Evading JavaScript, Mostly on Magento DevFeed: [Hackers Infect 953 Online Stores With Scanner-Evading JavaScript, Mostly on Magento]() Original publisher: [Read original article]() Author: The Hacker News Published: 2026-10-26T18:12:22Z Content type: news Language: en Sources: [Cyber Newsroom]() Topics: [Cybercrime](), [JavaScript]() Tags: [campaign](), [cyber-attack](), [e-commerce](), [e-commerce-security](), [javascript](), [magento](), [malware](), [scanner](), [vulnerability](), [web-security]() ### AI overview Sansec reports a campaign active since July 2025 that injected malicious JavaScript into 953 online stores, mostly Magento. The code is staged in Magento CMS blocks and contacts attacker-controlled servers, whose loaders filter bots and security scanners so shoppers may receive malicious code while scanners receive nothing. One loader version stores its payload in browser localStorage for execution on later visits; a newer version builds bot filtering into the loader and drops the earlier Keitaro traffic-distribution component. The final payload is unknown. Sansec estimates 471 stores were injected through PolyShell (CVE-2026-48356); another 102 had files uploaded through PolyShell or SessionReaper (CVE-2025-54236). A separate reported case used a rogue administrator account despite current core patches. Site owners are advised to check for suspicious accounts and unexpected CMS blocks or pages, keep sites updated, and enforce strong passwords. ### Source excerpt Hackers Infect 953 Online Stores With Scanner-Evading JavaScript, Mostly on Magento An unknown threat actor has infected 953 online stores, most of them running Magento, as part of a long-running campaign active since July 2025. According to Dutch e-commerce security company Sansec, ... Read more Published Date: Oct 26, 2026 (5 hours, 50 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-109619 CVE-2026-109618 CVE-2026-48356 CVE-2025-54236 ## Joint user-item allocation for e-commerce marketing campaigns DevFeed: [Joint user-item allocation for e-commerce marketing campaigns]() Original publisher: [Read original article]() Author: Maja Lindstr\\"om, Natalija Glisovic, Jan von Pichowski, Tommy L\\"ofstedt, Martin Rosvall Published: 2026-10-26T04:00:00Z Content type: article Language: en Sources: [arXiv: Machine Learning]() Topics: [concept-learning](), [thompson sampling]() Tags: [affinity](), [amazon](), [bandit](), [budget](), [campaign](), [capacity](), [commerce](), [computer-science](), [cs-lg](), [e-commerce](), [greedy](), [machine-learning](), [marketing](), [multi-armed-bandit](), [users](), [web]() ### AI overview The paper formulates auto-targeting as jointly assigning users and products to multiple disjoint campaigns with audience caps, maximizing user-item affinity. It compares constrained spectral biclustering, greedy local search with pairwise swaps, and multi-armed bandit methods against a conventional pipeline that fixes one side of the assignment before optimizing the other. Across synthetic data, two Amazon Reviews benchmarks, and two proprietary commercial datasets, auto-targeting reportedly improves campaign lift over the best decoupled pipeline by around 20% on the two smaller, denser datasets and more than threefold on the two largest. Biclustering achieves the highest campaign quality across datasets; bandit-based methods run fastest on the largest datasets. ### Source excerpt arXiv:2606.09623v2 Announce Type: replace Abstract: Web platforms run many marketing campaigns at once, and for each one they must decide which products to promote and which users to target. The best users depend on the products, and the best products on the users. The campaigns also compete with one another, because each user and each item may belong to only one of them and each audience is capped by the campaign budget. Still, existing approaches fix one side and search the other, choosing an assortment and then looking for its audience, or ranking items for one user at a time. Either way they solve a restricted version of the full problem, implying that a jointly optimized assignment would be at least as good and possibly far better. What the restriction costs, and whether the joint problem is solvable at the scale campaigns are run, remain unknown. Here we formalize the joint task as auto-targeting: assigning users and items to multiple disjoint, capacity-bounded campaigns that maximize the affinity between them. We adapt constrained spectral biclustering, greedy local search with pairwise swaps, and a multi-armed bandit formulation to the task and compare them against the conventional decoupled baseline. On synthetic data, two Amazon Reviews benchmarks, and two proprietary commercial datasets, auto-targeting raises campaign lift over the best decoupled pipeline, from around 20\% on the two smaller, denser datasets to more than threefold on the two largest. Biclustering yields the highest campaign quality across datasets, while bandit-based methods run fastest on the largest ones. ## Ukraine Is Wiping Out Data Centers Across the Border DevFeed: [Ukraine Is Wiping Out Data Centers Across the Border]() Original publisher: [Read original article]() Author: BeauHD Published: 2026-10-23T16:00:00Z Content type: news Language: en Sources: [Slashdot]() Topics: [data centers](), [digital sovereignty](), [AI Factory](), [national security]() Tags: [ai](), [ai-race](), [attacks](), [banking](), [chips](), [cloud](), [cloud-services](), [commerce](), [cooling](), [critical](), [data-center](), [data-centers](), [digital-sovereignty](), [disrupted](), [drones](), [e-commerce](), [infrastructure](), [internet](), [nvidia](), [ukraine]() ### AI overview Ukrainian drone strikes damaged data centers serving Yandex, Sberbank and VKontakte, disrupting services including cloud computing, banking, e-commerce and ride-hailing. The excerpt says Yandex's affected sites housed its three top-500 supercomputers; sanctions and shortages of high-end Nvidia chips could make repairs difficult or take years, potentially setting back Russia's AI ambitions. Data centers are vulnerable because they concentrate servers and power and cooling systems, and even relatively light explosives can cause lasting damage. The attacks followed Russian strikes on Ukrainian data centers that disrupted internet and TV broadcasts. Ukraine's storage of critical data on allied European servers helped limit damage, while Russia's policy requiring domestic storage leaves infrastructure and data more exposed. The excerpt says the attacks may prompt Russian companies to move data abroad or lead authorities to ease internet controls. ### Source excerpt Ukrainian drone strikes have damaged three major Yandex data centers as well as facilities serving Sberbank and VKontakte (the country's equivalent to Facebook), disrupting cloud services, banking, e-commerce, ride-hailing and other digital services across Russia. The attacks may deal a longer-lasting blow to Russia's AI ambitions: Yandex's affected facilities housed its three top-500 supercomputers, and experts say sanctions and shortages of high-end Nvidia chips could make repairs difficult or even take years. "This effectively sets Russia far behind in the AI race, "said Mikhail Klimarev, head of the Internet Protection Society activist group. Fortune reports: Data centers are the latest targets of aerial campaigns waged by both sides against each other's vital infrastructure. [...] Kyiv's attacks on Russian data centers closely followed Moscow's recent strikes on data centers in Ukraine, which disrupted the internet and TV broadcasts. On Oct. 8, Ukrainian drones hit a Yandex data center in Sasovo in the Ryazan region that houses two of the company's three supercomputers. A data center in Kaluga was hit a day later and the one in Vladimir was struck Oct. 11. The data center and AI hub for Sberbank was hit Oct. 14 in Balakovo in the Saratov region, and four days later, Kyiv struck a data center in St. Petersburg serving VKontakte. While oil refineries and warehouses are easy prey, data centers are even softer targets -- massive buildings packed with servers and supporting power and cooling infrastructure. Lasting damage can result from a drone carrying a relatively light load of explosives. [...] Ukraine has stored critical data on servers in allied European countries, helping limit the damage from Russian attacks. But Moscow's strict digital sovereignty policy requires all data storage at home, making it extremely vulnerable. "Because all the infrastructure and all the data is located inside Russia, it's relatively easier to take down," [said Nick Reiners, senior [Next page]()