CubeCart 6.7.4 added a statutory cancellation workflow for UK and EU merchants, a proper command line cron runner, and gzip compression of order baskets.
Magecart injects JavaScript into your checkout to copy card details as customers type. The shop keeps working, the order completes, and nothing looks broken. Here is how it gets in and what actually reduces the risk.
One shared image component everywhere, image search across the file manager, per-option product images, and uploads that select themselves. Plus the protective htaccess worth checking after a migration.
CubeCart now records every admin action with actor, IP and a diff, logs outbound HTTP calls, and deduplicates error rows so the log is actually readable.
CubeCart email now sends asynchronously via cron, tracks opens, and generates plain text automatically. It also shipped with a bug that sent blank order confirmations, fixed in 6.7.2.
MySQL moved away from MyISAM in 2010, but plenty of WordPress, WooCommerce and older store databases are still quietly running on it. Table level locking costs you exactly when you are busiest.
Seven built-in reports with xlsx export, including the Search Terms report that tells you what shoppers looked for and did not find. Plus the pagination bug that made earlier exports unreliable.
CubeCart 6.7.0 added a full sales reporting suite, asynchronous email with open tracking, and an audit log. It also removed the in-app database backup tool and the cookie consent banner.
Other sites displaying your images from your server costs you bandwidth and gives away your product photography. Blocking it is a checkbox, and breaking your own Google Images traffic is just as easy.
Six relevance improvements, a graceful fallback when the cluster is down, and a quiet failure mode where the indexer reports success but indexes almost nothing.