There are several ways in which the older, now-patched, vulnerability might have led to the recent attacks, the company said. Either some customers did not apply the patch for it at the time, or they did, but failed to reset all passwords, or they did both, but some of users reverted back to their old, possibly stolen, password.

The company also advised customers that after patching and changing all passwords, they should delete the active session records from the Plesk database.

Plesk 11, which was released in June, is not vulnerable to the older SQL injection vulnerability and doesn't store passwords in plain text like previous versions did. This means that even if a new vulnerability exists, attackers wouldn't be able to use it to steal customer passwords from Plesk 11 databases.

However, a lot of people still use Plesk 10, Plesk 9 or even Plesk 8, because upgrading is not a straightforward process and might break compatibility with other software that is running on their servers.

It seems that one of the most reliable methods of stopping the current attacks is to remove access to the Plesk file manager, which is what the attackers are using to insert the malicious code, Sinegubko said. "However this approach doesn't close the security hole, it just removes one of the attack dependencies. Attackers can still find some other way to use the passwords they have."