PHP2Shell Alert: Patch the Servers You Use, Retire the Ones You Forgot

อ่านภาษาไทย

A Nationwide Alert Over the Language Behind Most Websites

On 22 October 2026, Thailand's cyber agencies moved quickly on two critical flaws in PHP, the programming language that runs a large share of the world's websites. ThaiCERT, the response team under the National Cyber Security Agency (NCSA / สกมช.), warned that the bugs, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed "PHP2Shell", can let an attacker with no account send crafted requests that run commands on a web server and take control of it from outside. Both carry a CVSS v4.0 score of 9.2, and ThaiCERT noted that proof-of-concept code is already public, according to its advisory.

The same day, Deputy Prime Minister and Higher Education Minister Yodchanan Wongsawat told universities and medical school hospitals to check every PHP system, starting with patient records and student databases, while the Personal Data Protection Committee office (PDPC) urged website administrators to patch, review their logs and follow breach procedures if anything looked wrong, as reported by the Bangkok Post. The Bangkok Post also noted that the flaws were found by OpenAI researchers in August and kept quiet until fixes were ready, and that the official statements were preventive: no confirmed Thai data breach had been linked to PHP2Shell at the time.

The fixed versions are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 or newer. PHP 8.1 and older are out of support and get no fix from the PHP project itself, so ThaiCERT advises moving them to a supported version or getting patches from a Linux distribution or extended-support provider. A day later, ThaiCERT flagged a further PHP session flaw, CVE-2026-115560, still without a patch, and repeated its advice to switch off session upload progress in the meantime, as summarised by Thai Data.

The Line in the Advisory Most Companies Will Skip

ThaiCERT asks organisations to check the PHP version on every system they own: web servers, application servers, containers, hosting control panels, packaged products with PHP inside, and backup systems. For machines that cannot be patched or protected with the temporary settings, it suggests cutting them off from the internet or restricting access to approved IP addresses.

That is easy for the website your marketing team updates every week. It is much harder for the systems nobody remembers: the 2019 campaign microsite still running on a spare server, the old intranet or HR portal on PHP 7, the staging copy of the e-commerce shop with a real customer database, the backup box that still answers on port 80. These are exactly the machines most likely to sit on an end-of-life PHP version, and exactly the ones that hold years of forms, logins and customer records.

What This Means for Your Company

• Every forgotten server is now an open question. If you cannot say which PHP version a machine runs, who owns it and what data it holds, you cannot patch it with confidence, and you cannot prove it was not touched.
• Some systems should be retired, not patched. If a site or portal has no business owner and no reason to exist, the cheapest fix for PHP2Shell is to decommission it. Migrating an abandoned PHP 7 application just to keep it alive rarely makes sense.
• Switching it off is not the same as deleting the data. A powered-down server in a storeroom still carries its databases, upload folders and backups on its drives. Under the PDPA data destruction requirements, that personal data remains your responsibility until its destruction is documented.
• The regulator is watching breaches closely. On 21 October the PDPC told journalists it had received 1,650 personal data breach notifications from 2023 to 31 May 2026, with the finance, investment and insurance sector reporting the most, according to MGR Online.

A Practical PHP2Shell Clean-Up Plan

1. Run an inventory of every machine and container that serves PHP, including outsourced sites, test copies and backup servers, and record the version, owner and the personal data each one holds.
2. Patch the systems you still need, starting with internet-facing ones and those holding customer, patient or student data, then restart PHP workers as ThaiCERT advises.
3. For systems with no owner or purpose, export what you are legally required to keep, take them offline and plan their retirement.
4. When the hardware leaves service, book server data destruction so the drives behind those old databases are dealt with properly, send loose disks from old web hosts and NAS boxes for hard drive and SSD destruction, and fold a wider refresh into one IT asset disposal project.

For server jobs we can collect from your Bangkok office, log serial numbers on collection, keep a full chain of custody through destruction, and issue a Certificate of Data Destruction for each server (serial number, method and date) with a full inventory report. Photo and video evidence of the physical destruction is available. We handle devices only; we do not shred paper.

If PHP2Shell has turned up servers your team had forgotten about, get an instant quote or call 082-797-3702, and we will make sure the data on those retired machines is destroyed for good, with the certificates to show for it.

Sources: ThaiCERT, PHP2Shell advisory (22 Oct 2026); Bangkok Post, "Thailand races to protect data after PHP alert" (22 Oct 2026); Royal Thai Government, NCSA response to PHP2Shell (22 Oct 2026); Thai Data, PHP2Shell measures in Thailand (22 Oct, updated 25 Oct 2026); MGR Online, PDPC media briefing (21 Oct 2026).