We might be able to help you assessing things if you can make available information like system and daemon logs, (net-facing) software inventory (versions, configs, logs) and such. If that sounds interesting and you have time to spare you're invited to email me but please do not attach anything unrequested.

not surprised. you have a poor-coded CMS(probably was written by someone who never been on the net so don't know it is full of dangers), probably a cracker exploited a hole in that, then he gained permission to execute code(yet another mistake: to allow shell access) or BOFed PHP, then he BOFed kernel and he's root.
you still didn't provide us any details about your software and kernel versions. i can think of nothing else then the way i described. version of kernel means almost nothing: the thing is most important is not "what" but "when": when was the kernel built?
pastebin your process list also.

You may or may not be right but without "evidence" your statement equals guesswork. That's not what we're after in the Linux Security forum. Please work with facts, not fiction.

I know, sorry.
This is why I ask maydaymayday for more details: for me and other people here to stop play guessing game.