Hosting on Apache/2.2.22, scan says outdated

I am web hosting websites on Apache/2.2.22 and did a security scan. The scan said the server software is outdated, the web hosting provider says its not outdated and a stable. Someone uploaded malware to non-www directories.

Could the malware have happened due to the outdated Apache/2.2.22 software?