Hi Mary,
Sent this stuff to DanG and would have sent it privately but couldn't find an email address I was sure would work.
Some further information about how bads guys are getting root on these web servers.
In Jan - Feb 13 there was a spate of web servers sending out spam. Turned out they had been rooted via SSHD and were sending out spam (I know Darkleech is serving web pages but once you have root you can choose your tool).

There was also the cPanel compromise (ARS passim) wherein a tech support workstation got infected which was able to compromise the proxy server the workstation was sat behind and lots of people who had given cPanel Support SSH passwords got their servers compromised in the same way -- libkeyutils library.

But lots of machines without cPanel were getting infected the same way so how?
WebHostingTalk did a lot of investigation into this (it's 97 pages) and the following points emerged (Igor Seletskiy of Cloudlinux and Steven Ciaburri participated extensively):
-- Those servers where SSH keys were used to login and SSH passwords were disabled didn't get infected.
-- Those servers where SSH login was restricted to a particular set of IP addresses didn't get infected.
-- Other than that it didn't matter what kind of Linux you used or which web server (Apache,NGinx, etc.) -- but the BSDs were unaffected and they use a different SSH mechanism.
-- Their conclusion is that the workstations used to login to the web servers over SSH were infected with a trojan/keystroke logger. (They actually found a workstation which was used to SSH into the web server and discovered the keylogger). They also observed a malicious SSH login while it was going on.

Meanwhile Bojan Zdrnja at ISC has also been investigating this and finds similarities with the Ebury Trojan of 2011 -- he thinks a large part of the Ebury code is re-used but there is a crucial difference: in Ebury it patched the whole SSHD which made it easier to discover and was vulnerable to
being over-written during routine patching. The libkeyutils library is not changed that often so much less chance of being over-written.

References:
Webhosting Talk
http://www.webhostingtalk.com/showthread.php?t=1235797&page=97
(This is the last page -- see Patrick's summary)

ISC
https://isc.sans.edu/diary/SSHD+rootkit+in+the+wild/15229

Cloudlinux
http://www.cloudlinux.com/blog/clnews/sshd-exploit.php
(See Igor's last Comment)

Best wishes,