This morning a new worm for Linux appeared on the Internet. This is the second worm in the last couple of months. (The one before this one, Lupper, appeared on 7th November 2005). This shows how relatively rare Linux worms are in comparison to Windows worms.

We've called the new worm Net-Worm.Linux.Mare.a, and it uses php include to propagate. A modification of Backdoor.Linux.Tsunami spreads together with the worm.