rkhunter found this...

[Tom Horsley]

On Thu, 26 Mar 2009 20:07:54 -0400
brian wrote:

> > It means some script somewhere did an rm -f on /dev/null
> > then later some other script redirected output to /dev/null
> > thus creating it as a regular file.
> >   
> It looks more like a typo, as another poster said (one L).

Could be, but I had /dev/null deleted on a machine once and
the ensuing fun was really spectacular :-).

Doing "whatever > /dev/null" wasn't too bad, but when
someone said "whatever < /dev/null" amazingly random things
could happen.