I had a friend who was hosting at a relatively small ISP who got attacked similarly. Luckily, those attackers were very clumsy and broke HTML in process (didnt close tags properly), making detection very easy.

I was researching a bit on how these attacks are done, but still not sure on details.

Someone gains root on host machine and then gets to the individual instances?