So.. I followed your advice, Kafkaesqui and whooami, and upgraded to 2.0.1. Changed passwords.
And guess what: I didn’t help. Got hacked again the very next day.
My index.php-file keeps getting changed. I have to manually overwrite it with the original file.
I would be happy for any (less condescending) advises from anyone.