Lately, I took the time to find out what kind of OS is the source of the really crummy web-based attacks, and yup, you guessed it, linux.
Most of these exploit crummy php web applications that crummy programmers write, and crummier people actually run.