Dark Reading reports three newly discovered Linux backdoors built to look like legitimate mail security products from Asian vendors. The write-up says they walk and quack like legitimate edge solutions, so it is hard to tell they are not.

A mail gateway sits at the network boundary and handles every inbound message. It runs with high privilege, and nobody expects to read its process list. An implant named after the product the administrator is paying for does not need to hide. It only needs to be where the product would be.

The same week, Fortinet warned that CVE-2026-104286, a path traversal flaw in FortiMail rated 9.8 out of 10, was being exploited as a zero-day to run unauthorized code, and CISA added it to its exploited-vulnerabilities catalogue on 1 October. Neither report links the two. A defender reading both still ends up with the same task, which is to find out what is running on the mail gateway.

Many organisations may not have a ready answer to that. Edge appliances tend to be treated as sealed units, patched when the vendor says so and inspected when something breaks.

The control that changes this is a baseline. Take the file hashes and running services from a known-clean gateway, store them off the device, and compare against them on a schedule. A backdoor named after the product passes any check that reads names. It fails a check that reads hashes.