From the cobalt developers list
Hi, there is a temporary solution for this worm : run chmod 700 /usr/bin/gccas root. The worm needs to be able to compile in order to execute. Disabling the execution permissions for the httpd user will prevent this, therefore prevent the worm from executing. It's nothing permanent of course, since no one will be able to compile apart from root...Wouter van Reeven