FYI: the majority of webserver hacks rely on missing patches or poor configuration. Typically exploits utilising these are built into automated packages that are then used to scan for vulnerable hosts (often by what is termed a script-kiddie). When a server is exploited most of them time it is a server level issue such as this, rather than any individual webapplication at fault. Without further details e.g. the url's or/and the defaced page(s), I cannot give any better information.

Cathal