Just to add a case,
I have 3 PCs running 7/24 on Slack as servers.
Sooner or later it had to happen:
I ran sshd and proftpd for all users accounts to be accesible both-sides on one of the machines (primary a mail-server). From when the system got compromised (one interface is on the internet) to when I found out, passed months (low-level activity)...
Nothing is ALLWAYS
Everything is SOMETIMES
Everything is MAYBE
^ take that for granted. Now i know better :-p. And I'm up to some serious homework ==> security.

@win32sux:
I agree that exposing fresh sysadmins to windows-servers imposes them ireperable brain-damage beyond any hope of recovery. :-p Learned that the hard-way...

Of course when you got to build your house by your self; you are the one knowing where all things lay: and why...

IMHO:
Linux HAS the ability to be immune to viruses any time. But to fulfill that ability IT HAS to be setup SO!
One has to know HOW, WHY and to what extent...

Do your homework, allways :-)
I'll go do mine now...

I have a few questions. Was this technically a "Linux" exploit at all? Is a php exploit technically a "Linux" exploit? Could this same exploit be used on the same version of php on *BSD? Could this same exploit be used on the same version of php for MSwindows?

Could this same exploit be used on Linux and php on sparc machines?

If there was an exploit in Perl, would that also be considered an exploit for Apple?

What if I don't run php on my Linux system?

Is it really a "Linux" exploit at all...

And then the room went silent.

Depends on the specific PHP vulnerability. Most are cross-platform and affect other OS's as well. However, there are Linux-specific and even distro specific PHP vulnerabilities so it depends. Distro-specific vulns usually arise from configuration issues rather than your standard coding error (buffer overflow, format string, etc). Regarding the viruses, not sure if they would run on BSD, but in theory all you should need is a POSIX-compliant system that uses the ELF format.