You were the one hosting an exploitable application.

You say this like it's their fault. The only way not to be sure you won't end up hosting an application vulnerable to a 0-day is not to host anything at all.