I was expecting a detailed account of how the server was compromised, although this account of the drive-by malware operating details was interesting too.
My money is so far on Darkleech apache module[1] as the cause. As far as I know it's still unclear how the attacker gains root access to the server to do the install.