Most likely vector: outdated software. Make sure you apply any and all updates to all software running on your site.

If you have the ability to disable or aggressively restrict remote file includes and filesystem access within PHP, do so.

__________________
Dan LeFree | Product Manager (Linux VPS Hosting) | Owner/Operator (Web development, marketing)