Today some sites were defaced in our WHM/cpanel VPS. I understand that the common cause of this is outdated scripts/plugins/etc. However as I was checking the file manager of one of the accounts I saw a .txt containing a bunch of information about the server including a list of usernames of all the accounts inside home directory. I now begin to believe the issue might not be outdated scripts but some security hole in the server itself.
Here's the screenshot of the file:
Note that the root password was never used to login as I am always notified when it happens.
My question is how can a hacker obtain this information? The in-house server management staff where I rent the VPS only said it's due to outdated Wordpress/software but I do not think so. I think this is too much information to be obtained by just an outdated script.