2
something like that happened to me sometime ago, I was in a shared server running 20 xoops, had some kind of virus thing that inserted some extra lines of corrupt code randomly to .php and .html files. It was not an attack done directly to a website but maybe something that spread throught the server cause all the sites got the virus at the same time.
Keeping your files correctly chmoded is one thing (I've been told folders should be 755 and files 644, don't know if I've been told wrong), installing XOOPS Protector, having the most recent XOOPS version and running the latest security script that skalpa released should keep you partly safe. Nothing is 100% safe.