Once an attacker has gained root, it's often hard to tell how they got in because they can modify the system including logs. Unless you have logs going off to another system over the network, you may be out of luck -- particularly since you mention the logs being modified.
Obviously, the lesson learned is that you need to stay up to date on patches. We apply patches usually within a day of them being released via yum/apt-get.
Note that an attack against PHP, Apache, or Wordpress probably would have only given the attacker web-server privileges. But it seems from your description that they definitely got root. So if they did get in via a web app, there was another compromise to allow them to get from Apache to root. But I'm also wondering if they got in via a weak root password on SSH, etc...
However, knowing the method to attack it probably won't allow you to clean up from it. The machine is compromised very seriously at this point, from your description, and your best bet is to install a new OS from scratch and set the system back up. Audit all data and software you bring over from the old box. It is VERY difficult to fix a compromised box.
In any case, to answer your question about if there's any way to find out, here are some common places to look for what happened:
- /var/log/syslog or /var/log/messages -- look for when the attack may have happened, possibly by gaps in the log, or activity you can't explain.
- Other logs maybe they didn't wipe out like /var/log/security
- .bash_history of various accounts including root and the web server. This may provide the commands they ran or information on what was done.
- Look for processes that are running that you don't recognize, or processes that you do recognize that may be running from unusual directories or names. Look at /proc/$PID and /proc/$PID/fd of the various process IDs ($PID) of processes you see running.
- Perhaps "last" will tell you something, but they probably wiped it out.
- rkhunter can help tell you what is compromised on the system and help to find where you can look for more information.
- Apache logs may show some indication of unusual activity, but it's often hard to filter out the attacks you get all the time from the one that actually broke the system open.
Much of this work is serious cross-correlation between different log files to find out what is interesting and what is just noise.
Doing this sort of investigation is not quick work. It's probably going to take 4 or more hours, especially if it's your first time doing one.