It appears it's the usual mass defacement, so they are probably exploiting a well-known vulnerability.
You are not the only one, I checked for other domains hosted with webfaction.com (Which seems to be a re-seller hosting service using linode, I could be wrong):
eyetraveldoc.com*
themediashow.net*
These were also defaced (these are using the same IP as yours), so there is a high chance that your hosting service is running a vulnerable kernel, service or the node you're on is. So notifying them and continuing from there would be a good start.
*They have been restored, but a mirror is on zone-h
http://www.zone-h.org/archive/notifier=T0xic
It appears it's the usual mass defacement, so they are probably exploiting a well-known vulnerability.
You are not the only one, I checked for other domains hosted with webfaction.com (Which seems to be a re-seller hosting service using linode, I could be wrong):
eyetraveldoc.com*
themediashow.net*
These were also defaced (these are using the same IP as yours), so there is a high chance that your hosting service is running a vulnerable kernel, service or the node you're on is. So notifying them and continuing from there would be a good start.