The 2.6 kernel series ran from 2003 - 2011 with plenty of patches. For a production system, anything from 2006 on isn't really old. The way this article leads off is very misleading. You make it sound like it is the kernel itself that is the problem, with no direct proof. To quote you:

"I suspect that we’re seeing this as a marker for older machines rather than as an indication of a kernel vulnerability. It is likely that the attackers have identified a vulnerability in some software that is common to the affected servers that we haven’t found or can’t see."

That is a very confusing statement to make in face of the article. You also keep referring to web servers, what web server are we dealing with? People are assuming Apache, but there are many more web servers for Linux available.

This blog post slowly starting to trend in tech circles and a lot of bloggers are confused. Maybe re-write the whole thing?

Although it's good to know that users of Cisco’s Cloud Web Security solution are protected from this attack.