Thai Deputy PM Orders Urgent PHP Security Upgrade

Deputy Prime Minister Yodchanan Wongsawat has directed all government ministries under his portfolio to urgently inspect and upgrade their PHP systems. The order follows a severe Thai government PHP security vulnerability alert that could expose sensitive personal data across public institutions.

Yodchanan Wongsawat, who is also Minister of Higher Education, Science, Research and Innovation, instructed agencies under his ministry to inspect and upgrade their systems. He is now coordinating with other relevant ministries on preventive measures. The directive was triggered by a warning from the Personal Data Protection Committee about serious flaws in the widely used programming language.

Vulnerability details and risk

The flaw in the PHP language could allow unauthorized access to systems, putting large volumes of personal data at risk. The Personal Data Protection Committee warned that the vulnerability could enable malicious actors to access and take control of systems without authorization. OpenAI researchers detected a major PHP security weakness in August but kept the news quiet to give developers time to prepare updates. The PHP Foundation has since released a fix that it urges all users to install.

Websites and related systems needed urgent inspection, particularly patient information systems and student databases. Mr. Yodchanan urged the public to remain calm but stressed that Thai organisations needed to act quickly.

Priority targets and immediate actions

Universities and medical school hospitals have been singled out as high-priority targets for inspection and updating because they hold large amounts of important public data. IT teams were told to review every website and application using PHP.

The Office of the Personal Data Protection Committee alerted organisations and website administrators to take four immediate actions:

Public guidance and ongoing coordination

While awaiting upgrades, organisations should activate additional network or cloud protections and monitor for unusual access to block suspicious activity. The ministry's response centres on identifying vulnerable systems, reducing exposure during the upgrade process, and installing security fixes.

The public was advised to monitor announcements from relevant agencies and avoid links offering system updates from untrusted sources. "I had instructed agencies under my ministry to inspect and upgrade their systems, while coordinating with other ministries," Yodchanan Wongsawat said.

Users of online services who discover a provider is using an outdated PHP version should contact its administrator about security updates. Anyone who suspects their personal information has been accessed or disclosed without authorization should contact the relevant organisation or service provider immediately. The statements call for preventive action and do not identify a confirmed personal data breach in Thailand.

The minister continues to coordinate with other ministries as the fix is rolled out, with the public advised to follow official announcements closely.