My server was hacked this weekend. By the Russians! Of the 50+ domains on my server, every single one had a hacked .htaccess file which was redirecting search results and a few other things to a russian site.
I'm assuming that one of the many, many wordpress installs has a plugin with a security flaw.
- Is it possible for a security hole in one plugin to allow someone access to other sites on the same server?
- What would a security flaw look like that might give someone access to the .htaccess file a directory or two above?
It's possible that the issue was someone else, that Dreamhost (my host) has bigger issues. But, I'm exploring the option that it's my fault.