It was probably probing, not exploiting, and the “.php” and query parameter probably helps it get filtered away under some common log filter regex/rules. It’s

It was probably probing, not exploiting, and the “.php” and query parameter probably helps it get filtered away under some common log filter regex/rules. It’s goal was to see how your server responded to that kind of request (relative path that escapes html root, probably) without standing out too obviously in your logs. Based on the response it provided, your server might have gotten bumped into a list for more targeted probing or exploitation.