Nine times out of ten with a targeted compromise like this the trail will lead back to a successful spear phishing campaign. Blanket the staff with a malicious

Nine times out of ten with a targeted compromise like this the trail will lead back to a successful spear phishing campaign. Blanket the staff with a malicious pdf, an exclusive first look at a new popular executable, or an older browser exploit. Once you've compromised a client machine (essentially inevitable as long as you have a few dozen or more staff), use that to discover CMS/FTP/SSH credentials, or impersonate the user to request new ones. Once you have a user login on the server, as noted the old kernel reference was undoubtedly connected to a privilege escalation. Directly exploiting remote flaws in an OS on a major website is usually going to be pretty hard - they focus security efforts there and if there were any existing flaws they'd likely already have been compromised by them (and since fixed it)