Hi all xoops'ers

i just want to asking something .. i use xoops for 3 years but recently my xoops got defaced .. they injected the "index.html" so everytime i access my xoops ex . http://www.myxoops.com the frontpage show deface page from index.html not from xoops system .. so i just want to ask .. how that can happen .. how they can inject index.html to my document root

fyi :
im using xoops 2.0.18 version with module :
- news
- edito
- marquee
- photo gallery
- pddownloads
- protector


thanks