This is a common exploit, there is even a 41 page thread about it over on the cPanel forums.
Here are the most common ways reported:
1.) Vulnerable PHP Script (Poor Script, Out of date, etc...)
2.) One of your FTP accounts have been hacked, change all the passwords to each one.
3.) Poorly...