Pull the DebugBear script today, opt out of ChatGPT ad rewrites before BFCM

DebugBear's RUM script was hijacked. Remove it today.

On October 29, attackers compromised DebugBear's DNS records at its domain registrar and swapped the Real User Monitoring script served to Polymarket. The malicious script ran for roughly fifty minutes, draining about 28.6 million POL (around 2.6 million dollars) into an attacker wallet. Polymarket has since announced it is returning 3.9 million dollars to affected traders. DebugBear found no evidence of broader internal compromise but told customers to remove the RUM script from their sites.

Who it hits: any site, agency, or client stack that embeds DebugBear's Core Web Vitals or RUM script. This is a direct third-party JavaScript risk sitting on your pages right before peak traffic.

The move this week: open your tag manager or theme header, remove the DebugBear script tag, and confirm it is gone on a live page view. Then run a one-hour audit of every other third-party script loading in your head, note who controls each domain, and flag any you cannot justify keeping through BFCM. If you ran the script on October 29, pull server logs for that window and check for unexpected outbound requests from visitor sessions.

Search Engine Journal: DebugBear RUM attack and site owner actionsSecurityWeek: Polymarket returns 3.9 million to traders as DebugBear cites DNS hijack

ChatGPT Ads turned creative enhancements on by default

As of October 30, OpenAI switched creative enhancements on by default across new and existing ChatGPT Ads campaigns that had not already opted out. The feature lets OpenAI rewrite headlines and descriptions to match a user's conversation, translate ad text, resize images, and send clicks to a different page on your site. Variations can be generated in real time without per-version approval, and there is no preview of every variant.

Who it hits: every self-serve ChatGPT Ads advertiser, especially regulated categories, brands with legal-approved copy, and anyone whose tracking parameters live in the landing page URL. If a rewritten ad sends clicks to a different page, your analytics attribution can break silently.

The move this week: log into Ads Manager, open Manage Settings at the account or campaign level, and decide per campaign whether to opt out before BFCM traffic scales. If you keep it on, pull a sample of served variations into a shared doc so legal and brand have a record. Spot-check that your UTM parameters survive on the rewritten destination URLs.

Search Engine Journal: ChatGPT Ads turns on automatic ad changes by default

Google confirms tCPA and budget edits don't reset Smart Bidding on steady campaigns

On the October 15 Ads Decoded podcast, Google product manager Tal Akabas told host Ginny Marvin that changing target CPA, target ROAS, or budget on an existing campaign in a steady state does not trigger a learning period. The nuance that matters: the edit can still shift auction participation, volume, and efficiency, and this specifically applies to steady-state campaigns, not freshly launched ones. Large budget swings remain behaviorally risky even when they are technically not a reset.

Who it hits: PPC managers and fractional performance leads running established Smart Bidding campaigns into BFCM who have been hoarding edits to avoid a feared relearning window.

The move this week: pick your three highest-revenue steady-state campaigns, make the tCPA or budget change you have been delaying, and set a calendar check for 48 hours later to compare CPA, impression share, and conversion volume against the prior week. Keep single-change discipline so you can read the signal cleanly.

Search Engine Journal: Google Ads product manager revealed details that matter before Black FridayGoogle: Ads Decoded podcast on search data

Shopify ships GTIN autocomplete with GS1 validation

On October 29, Shopify Admin began checking barcodes against the GS1 registry as merchants type. Registered GTINs get auto-marked with a highlight, and bulk editors let you accept or dismiss every suggestion at once. Nothing is changed on existing saved barcodes unless you accept the suggestion, so there is no silent overwrite risk. A separate November 1 rule from Shopify blocks Shopify Shipping and Managed Markets labels for EU parcels at 150 euros or less when the item lacks a GTIN, EAN, UPC, or ISBN and the standardized identifier declaration.

Who it hits: Shopify merchants running Google Shopping feeds, Managed Markets, or shipping into the EU. Missing or invalid GTINs prevent Google from matching your listings to the right products, which gets expensive during BFCM demand.

The move this week: open the products bulk editor, run the GTIN autocomplete pass across your catalog, accept the validated suggestions, and spot-check a sample in your Google Merchant Center for item-level warnings. If you ship into the EU, confirm your under-150-euro SKUs either have a valid identifier or carry the no-standardized-identifier declaration before you need the label.

Shopify changelog: Admin supports GTIN suggestions and autocomplete

Discord sets November 16 and mid-December deadlines for public server content

On October 27, Discord announced a two-phase rollout for Discoverable Servers, which are public communities with at least 1,000 members. On November 16, Discord begins auto-creating Server Web Pages for every Discoverable Server that does not already have one, with automated summaries of public channel discussions. From mid-December, messages posted in public channels of those servers can appear on the public Server Web Pages and in web search results. Messages posted before the mid-December date will not be included, and usernames and avatars will not accompany indexed messages. The feature is default-on; admins must disable it.

Who it hits: brand and community managers running public Discord servers above the 1,000-member threshold, especially those with user-generated support channels, beta feedback, or heated off-topic rooms.

The move this week: in Server Settings open Community then Web Presence, review Channel Summaries and Channel Messages per channel, and switch off any public channel you would not want indexed. Then tighten moderation rules for the channels you leave on before the mid-December date, since content posted after that window becomes eligible for Google and AI summaries.

Search Engine Journal: Discord public server chats and search engines

Google AI Mode ads open in ten new markets

On October 28, Google's Shashi Thakur announced ads in AI Mode are scaling to Australia, Canada, India, Kenya, Malaysia, New Zealand, Nigeria, Pakistan, the Philippines, and Singapore, with Brazil, Mexico, and the UK planned for Q4. Google's help documentation currently lists English for these placements, with text ads only in Pakistan. Advertisers do not need new campaigns or separate budgets; existing campaigns targeting those geos become eligible to serve.

Who it hits: advertisers with campaigns geo-targeting any of the ten new countries, and brands with multi-market Performance Max or Search campaigns that span North America or Asia-Pacific.

The move this week: open Google Ads, filter campaigns by the ten new geos, confirm asset coverage (headlines, descriptions, images) is complete enough to serve across conversational placements, and add any missing English copy for Canada, Australia, India, and Singapore. If you have Pakistan traffic, confirm your text ads are in place. Pull a baseline report now so you can read the serving mix once AI Mode impressions start showing up.

Google: Ads in AI Mode expand to new markets

Shopify adds WhatsApp automations (non-US only, for now)

On October 28, Shopify added pre-built WhatsApp templates for abandoned browse, abandoned cart, and abandoned checkout inside Messaging then Automations, with the option to add WhatsApp to any custom automation. The catch is Meta still blocks WhatsApp marketing messages to US phone numbers, so the under-an-hour setup is only immediately actionable for international audiences. Shopify's help page notes you are charged per abandoned checkout SMS or WhatsApp message but does not publish a per-message rate for automations.

Who it hits: Shopify merchants with meaningful customer bases outside the US, particularly LATAM, India, MENA, and Southeast Asia, where WhatsApp carries more order recovery weight than email.

The move this week: in Shopify Admin go to Messaging then Automations, enable the WhatsApp abandoned checkout template for non-US geos, and gate it in your automation logic so US numbers continue to receive email or SMS only. Track recovered revenue by channel for two weeks to decide whether to expand to abandoned browse before BFCM peak.

Shopify changelog: Create WhatsApp marketing automations in Shopify Messaging

Checked, and quiet

The updated Yahoo Mail deliverability guide from Spam Resource is useful reference material and worth bookmarking before BFCM sends, but it is a practitioner update, not a new Yahoo policy. No new sender requirement, complaint threshold, or authentication change has been announced this week, so there is no concrete under-an-hour move tied to it. If your Yahoo complaint rate is already in a known safe range and your Sender Hub is set up, nothing material changed for you this week.

Spam Resource: ISP Deliverability Guide, Yahoo Mail (updated)