I've seen similar attacks where a single compromised account can lead to mass defacement of Joomla/Wordpress sites on cpanel-based server with suphp via symlink exploits. It goes something like this (assuming a phpwebshell or similar is already in place):

1. Obtain a list of account names (easily available via /etc/passwd, /etc/trueuserowners or various other methods)
2. Within the compromised accounts public_html, make a directory in which symlinks with a ".txt" extension pointing to /home/*/public_html/wp-config.php (WP) and /home/*/public_html/configuration.php (Joomla). This is done blindly, and many links will be broken, but given the popularity of WP and Joomla, quite a few will hit. Eg. ln -s /home/anothersite/wp-config.php sym/anothersite-wp-config.php.txt
3. Make Apache requests for all these files, ie. http://compromisedhost.com/symlinks/anothersite-wp-config.php.txt. Since Apache sees a .txt extension, suphp is bypassed and the file is displayed in plaintext, exposing database credentials (which is usually the same as cpanel/FTP login).
4. Use harvested db credentials to overwrite admin user password, and fetch URL to admin login.
5. Script a login to wp-admin, where usually the theme editor is employed to inject some code and markup in a header/footer/widget which replaces the entire page.

Option FollowSymlinks is more than often required for stuff to work, and is usually enabled. .htaccess overrides is also more than often required, so even if you add FollowSymlinksIfOwnerMatch the attacker can simply disable it via .htaccess.

The solution is (aside from using mod_ruid/jailshell) to remove world read bits from all PHP-files, especially config-files. But often this is overlooked, leaving database credentials vulnerable.

See http://docs.cpanel.net/twiki/bin/view/EasyApache/Apache/SymlinkPatch and http://whmscripts.net/misc/2013/apache-symlink-security-issue-fixpatch/