Well, a huge recommendation on the hosting front is that when a user has gained root your best bet is to reinstall the OS on the server...
You should always try your best to keep all scripts up to date; a lot of providers provide release updates via newsletters now adays.
In an ideal world I'd tell you to backup your criticdal files, have the os reinstalled (and try to use the latest release), setup iptables (linux firewall) to allow only mysql, ssh (on a nonstandard port), ftp, and the webserver (including ssl and any ports your control panel of choice requires) then make sure every password on the machine has been changed from what it was in the first place. Then I'd make sure every piece of software and script is up to date with the latest releases.
