Thai student earns NASA recognition after uncovering security flaw

KHON KAEN – A first-year university student in Thailand has received an official letter of appreciation from NASA after discovering and responsibly reporting a cybersecurity vulnerability in the US space agency’s information systems.

Thanaphon Butsreecha, a first-year student in the Cybersecurity programme at Khon Kaen University’s College of Computing, identified a Cross-Site Scripting (XSS) vulnerability that could potentially allow attackers to inject malicious scripts into web pages.

Using the online pseudonym “nullbyt3z”, Thanaphon reported the vulnerability directly to NASA’s security team through its Vulnerability Disclosure Policy (VDP), rather than exploiting the flaw or publicly disclosing its details.

His efforts earned him a formal letter of appreciation dated 5 November 2026 from NASA’s Office of the Chief Information Officer, signed by Kelvin Taylor, the agency’s Senior Agency Information Security Officer.

In the letter, NASA recognised Thanaphon’s efforts as an independent security researcher and praised his adherence to the agency’s responsible disclosure guidelines.

“Your reporting has facilitated NASA’s awareness of otherwise unknown vulnerabilities and helped us protect the integrity and availability of NASA information,” the letter stated.

NASA also commended his participation and expertise, describing the ability to detect and report security vulnerabilities as a valuable skill in the information security industry.

Thanaphon said he was proud that his efforts over the past month had contributed to improving the security of a major international organisation.

“I feel very proud that my efforts over the past month have genuinely helped make the systems of a world-class organisation more secure,” he said.

“The challenge was finding the vulnerability in the first place, and ensuring that every report submitted was not a duplicate of one already reported by someone else.”

The discovery involved an XSS vulnerability, a type of web security flaw that can allow malicious scripts to be inserted into web pages.

Thanaphon followed the practice of responsible disclosure, under which security researchers notify system owners of vulnerabilities through authorised channels, refrain from exploiting the findings and avoid publicly revealing technical details before the issues are addressed.

Asst. Prof. Dr. Phet Imthongkham, chair of Khon Kaen University’s Cybersecurity programme, praised the student’s achievement.

“This achievement demonstrates that our students possess both internationally recognised technical skills and professional ethics, which are at the heart of cybersecurity education,” he said.

Khon Kaen University’s College of Computing congratulated Thanaphon, saying his achievement reflected its commitment to developing cybersecurity professionals through practical experience and ethical training.

The recognition marks a notable achievement for the first-year student, whose cybersecurity research has earned formal acknowledgement from one of the world’s leading space agencies.