What should we do with Linux/Cdorked.A malware?

relies on code added to each server source. Unless you use something like CPanel or rely on nginx packages built without verifying the source package and not signed I don't see how it can creep in.

Also be wary of the nginx-full or similar packages from Debian and Ubuntu. They have everything and the kitchen sink inside. I build my own packages and tailor the build for the task. Compiling in modules on a needed basis.

It's important to verify the source if you're building it yourself (Nginx has a key available from GnuPG servers). I would say that the safest bet is to build it yourself and sign it with your own key. Yes it's a bit of work, but then you're certain that unless the Nginx servers were compromised and the release signing key also there's a slim chance of such a backdoor creeping in.

Use Samhain or a similar utility to keep an eye on the installed Nginx binary.