Off the top of my head, the errors may be link to a "local file inclusion" vulnerability attack. By accessing secret, hidden or misc files. Attackers can obtain information that shouldn't be disclosed. Since common way such as logs are typically harder to get at. Files such as specially prepared JPG's can be used too. Once open attackers can upload all the code they want. Of course without looking into it further, I may be wrong about what attack it is. But you mentioned having trouble with pictures. Graphics are commonly used in LFI. There are a few different methods to exploit this weaken. There's no indication from the entries anything was successful. It could have just been an automated bot scanning for sites with vulnerabilities. I would keep an eye on the logs to see if similar odd entries show up. If you really wanted to you could make sure all scripts are up to date, double check folder/file permissions, upload fresh copies of the pictures or have issues with. If you look up: local file inclusion , you can get a lot more info.

That's a good idea about banning the IP addresses. How big is your list?