Thai minister orders urgent PHP system checks to protect personal data
Universities and medical school hospitals are the priority as agencies review systems, install security updates and monitor for unauthorised access.
- Thailand's minister of higher education has ordered an urgent inspection and upgrade of government systems using the PHP programming language.
- The order is a response to a severe security vulnerability that could allow unauthorized access to systems and compromise personal data.
- The directive prioritizes universities and medical school hospitals due to the large amounts of sensitive student and patient data they hold.
- Agencies are advised to inspect systems, implement interim network protections, and promptly upgrade to patched PHP versions to fix the vulnerability.
Prof Dr Yoschanan Wongsawat, deputy prime minister and minister of higher education, science, research and innovation, said he had ordered agencies under his ministry to urgently inspect and upgrade systems using the PHP programming language following an alert about a severe security vulnerability.
He was also coordinating with relevant ministries on preventive measures, prioritising universities and medical school hospitals that hold large amounts of important data about members of the public.
Yoschanan said the vulnerability could allow malicious actors to access and take control of systems without authorisation.
Websites and related systems therefore needed urgent inspection, particularly patient information systems and student databases.
However, he called on the public to remain calm, saying work to develop corrective updates had been coordinated and protective measures had already been prepared.
The immediate priority was to implement those measures fully on all systems under each agency’s responsibility.
Three urgent steps to protect important databases
Yoschanan recommended that agencies in Thailand, particularly universities and medical school hospitals, take the following three steps:
- Prepare: Have information technology teams inspect all websites and systems using PHP, giving priority to patient information systems and student databases.
- Contain the risk: While preparing to upgrade core systems, activate additional network or cloud protections and monitor unusual access to block attempts to enter systems without authorisation.
- Fix the vulnerability: Promptly test and upgrade PHP to versions containing the security fixes specified in official announcements, addressing the source of the risk.
“There is no need to panic about this yet, but this is a very important moment for agencies in Thailand, especially universities and medical school hospitals that hold large amounts of important data, to act quickly to secure their systems,” Yoschanan said.
He also confirmed that agencies under his supervision were working urgently to resolve the issue, protect important data about members of the public and reduce the likelihood of malicious actors exploiting the vulnerability.
OpenAI coordinates with researchers to prepare fixes before disclosure
Information published by OpenAI on Wednesday (October 21, 2026) stated that the company had spent the preceding two months coordinating with PHP maintainers, researchers and security providers to address the severe vulnerability.
Calif identified a critical flaw with help from an OpenAI model under the Patch the Planet initiative, while Wiz also independently discovered and reported the vulnerability.
PHP maintainers led the development of fixes and the release of updates, with OpenAI and its partners supporting research and preparations for protective measures.
OpenAI stressed that organisations using PHP should prioritise installing the fixes promptly. Interim protections could reduce the risk but had operational limitations.
Data protection office calls for system and log checks
The Office of the Personal Data Protection Committee (PDPC) also alerted organisations and website administrators to urgently inspect and update their systems.
It warned that the PHP vulnerability could enable unauthorised system access, putting stored personal data at risk of access or disclosure and compromising information system security.
The PDPC recommended four immediate actions: inspect all systems and websites using PHP; update to versions containing the fixes specified in official announcements; review activity logs for unusual behaviour; and, if irregularities were detected or a data leak was suspected, promptly follow the relevant personal data breach response procedures.
Public warned about fake system update links
For members of the public, the PDPC recommended following announcements from relevant organisations and service providers, exercising caution when using online services and avoiding system update links from untrustworthy sources.
Anyone who finds that a service provider is still using an older, unpatched PHP version should enquire with or alert the system administrator so it can be checked.
People who suspect that their personal data has been accessed or disclosed without authorisation should immediately contact the relevant organisation or service provider to enable a prompt investigation and response.
