Statement from webmin here: http://www.webmin.com/exploit.html