StyleSmuggler: Magento’s GraphQL 0-day, and what a real fix has to look like
StyleSmuggler is an unpatched Magento and Adobe Commerce 0-day: unauthenticated remote code execution through GraphQL styles parameters. In the traffic we have seen, the PHP is embedded in a .gif and runs when Magento sends the payment-failed email. 2.4.9 is not a fix. If you do not need GraphQL, turn it off; if you do, block styles on /graphql and /paypal/transparent/response/ until Adobe ships a patch.