There is a security hole in Roundcube webmail pre-0.2
http://www.directadmin.com/forum/showthread.php?p=146742#post146742
provides further details of this.
my server was hit by the flaw, with two trojans being uploaded to /var/tmp
Am now in process of upgrading/removing roundcube versions pre-0.2
Status:
Closed (fixed)