We are a hosting Company for customers and never had problems. Now, the second customer site was "hacked" in one week. Our passwords should be safe and we change them often, instead I think there were backdoors used. One site was an old Joomla! Version. (from 2010). We've shut that down, but now we've got an abuse mail from our provider, because another site was "hacked". This is a wordpress installation (pretty new version, maybe 2-3 months old. As far as I see there has a zipfile
nca.zip been injected to the root folder, and that has been extracted somehow. All Wordpress files are still there.
Does anyone know how to prevent this?