You gotta love mis-reporting. They're calling it a "Linux" worm but it's really just a remote PHP/CGI exploit that doesn't expose root.

Here's what slashdot has to say:

McAfee reports that a Linux worm has been found in the wild. The Linux/Lupper.worm is a derivative of the Linux/Slapper worm which also exists for BSD, just to be crossplatform. From the McAfee description: The worm blindly attacks web servers by sending malicious http requests on port 80. If the target server is running one of the vulnerable scripts at specific URLs and is configured to permit external shell commands and remote file download in the PHP/CGI environment, a copy of the worm could be downloaded and executed."

Keep PHP and your scripts up to date.