What should I do if actually I found a serious flaw in someone's PhD thesis and an article derived from that PhD thesis?
One possibility is for you to write a paper on your reanalysis. Often this would need to be something more than pointing out the flaw alone, but that may be discipline-dependent. If the flaw you have detected is a key part in your own analysis of your work, including your updated analysis in a larger article (while citing their paper) is a smooth way to point out how you had to change the method.

The second possibility is that many journals (at least in my area) allow for Comments on articles they have published. These are for just this purpose - to point out something 'wrong' about a paper that has been published. If the editors decide to proceed with it, the original authors are usually given an opportunity to craft a Reply piece to agree, disagree, alter, whatnot. Then they are published back-to-back in the journal.