Completely forgot I had a server running there, I think it is actually a dedicated server, not VPS. It was vulnerable but seems to be uncompromised. Fixed it now.
I'm sure you're well aware but that server should not be trusted now for anything sensitive (or anything at all really) until it's been re-imaged.
Just having a vulnerable bash isn't enough to break in. You also need something that uses it. A CGI script available via webserver, or some other service (I hear OpenVPN had issues...)