Found the following snippet repeated about 30 times in my /var/log/apache/error.log file:

  sh: line 1: wget: command not found
  tar (child): m.tgz: Cannot open: No such file or directory
  tar (child): Error is not recoverable: exiting now
  tar: Child returned status 2
  tar: Error exit delayed from previous errors
  sh: line 1: cd: .sX: No such file or directory
  sh: line 1: ./inst: No such file or directory
  

It's pretty clear what the intent was; I'm just glad wget isn't installed on this server! Now to find out how they managed to execute the shell script...