By 'a lot of websites', I would assume you're referring to those hosted by 000webhost? If the answer is yes, then, mind the term, but the majority of those websites got raped.
Now then, as far I'm aware, 000webhost were using an older PHP version, that used a few deprecated and less secure features, which allowed hackers to utilize an exploit that was present in said older PHP version, which then allowed them access to 000webhost's PHP configuration and after a few tweaking, they allowed themselves access to all sorts of private areas and commands that required administrative credentials, and the rest you know.
As for avoiding security issues, I can go on and on about all sorts of pre-cautions you can take to protect yourself, but in all honesty, it's all about keeping your setup pretty much air-tight and up to date, you should never keep any unwanted modules that would be useless to you, always keep up with the latest security updates (automatic upgrade checks may not always do the job, so make sure to do some manual checking yourself, and if required, manual installation of those updates, of course after checking if they were issued by a trusted source).
Please take note that you should always keep your software up to date, regardless of how much a pain in the ass it may be to update it or how much time it could take to do so.