We are unaware of any current exploits in Webmin related to this, and I don't think we've had any reports of infected users, so far. That is not to say there aren't currently unknown exploits in Webmin, just that the correlation seems somewhat weak at the moment. And, of course, there have been exploitable conditions in Webmin in the past (the last major remote exploit was many years ago, however; most recent stuff has been XSS variants which would be pretty difficult to exploit, and were not seen in the wild, to my knowledge).

If I had to guess, it might be related to this: http://www.cloudlinux.com/blog/clnews/sshd-exploit.php

The details on that page are weak and there are all sorts of problems with the content in general (namely asking users to run a script blindly), but it seems to mimic what is described.

Or maybe there are still a lot of people out there who are running Apache as root.

While I agree it's not an Apache exploit, your post makes no sense. SSH is often tainted via permission elevation due to vulnerabilities in other daemons.