Thailand races to protect data after PHP alert

Priority is personal data on state websites, school and hospital databases

Thai authorities have urged organisations to urgently update websites and systems using PHP to prevent potential personal data leaks, with universities and medical school hospitals told to prioritise patient records and student databases.

The Personal Data Protection Committee (PDPC) warned that serious vulnerabilities in the widely used programming language could allow unauthorised access to systems, exposing personal information and threatening organisations’ information security.

Website administrators around the world have been checking their systems since reports about the PHP flaws — first detected by AI — emerged on Wednesday. The PHP Foundation has released a fix that it has urged all users to install.

Yodchanan Wongsawat, deputy prime minister and the Minister of Higher Education, Science, Research and Innovation (MHESI) said he had instructed agencies under his ministry to inspect and upgrade their systems, while coordinating with other ministries.

The statements call for preventive action and do not identify a confirmed personal data breach in Thailand.

OpenAI researchers detected a major PHP security weakness that could allow attackers to hijack affected systems in August but kept the news quiet to give developers time to prepare updates and protective measures.

Mr Yodchanan urged the public to remain calm but stressed that Thai organisations, particularly universities and medical school hospitals holding large volumes of important information, needed to act quickly.

The ministry’s response centres on three steps: identifying vulnerable systems, reducing exposure while upgrades are prepared, and installing security fixes.

IT teams should review every website and application using PHP, giving priority to patient information systems and student databases, Mr Yodchanan said. 

While awaiting upgrades to core systems, organisations should activate additional network or cloud protections and monitor unusual access to block suspicious activity.

They should then test and upgrade PHP to a version containing the security fixes as quickly as possible, he said. (Story continues below)

Higher Education Minister Yodchanan Wongsawat has instructed agencies under his ministry to inspect and upgrade their systems, while coordinating with other ministries following the warning about PHP programming flaws. (Photo: Ministry of Higher Education, Science, Research and Innovation)

The Office of the Personal Data Protection Committee said website administrators should also examine system logs for abnormal behaviour. If they detect suspicious activity or suspect personal information has leaked, they should promptly follow the relevant personal data breach response procedures.

For the public, the office advised monitoring announcements from relevant agencies and service providers and avoiding links offering system updates from untrusted sources.

Users who discover that a service provider continues to use an outdated PHP version should contact its administrator and ask about security updates.

Anyone who suspects their personal information has been accessed or disclosed without permission should immediately contact the organisation or service provider concerned, the office said.