Sometimes it's hard to tell if it's a real bug or a backdoor masquerading as a vulnerability.