Security Flaws Expose 10,000 Polish Public Entities to Cyberattacks, Researchers Find

How Researchers Found Critical Holes in Poland’s Public Digital Infrastructure

At the Def Con security conference in Las Vegas, two Polish researchers unveiled a sweeping web scan that laid bare the fragile state of their country’s public digital infrastructure. Using automated tools designed to probe common security weaknesses, Kamil Szczurowski and Robert Kruczek identified more than 10,000 public bodies—government offices, courts, hospitals, and airports—whose websites carried exploitable flaws. In total, the duo mapped vulnerabilities across 250,000 separate sites, many stemming from the same handful of underlying software bugs.

The most dramatic discovery centered on Pad CMS, a widely used content management system that has reached its end of life and is no longer supported. By leveraging unpatched flaws in the obsolete software, the researchers could gain password-free access to over 300 public websites. Another widespread issue exposed roughly two-thirds of Poland’s judiciary—some 245 courts—to potential takeover, effectively allowing an attacker to deface official pages, steal sensitive data, or redirect citizens to malicious clones.

The findings arrive at a tense moment for the country’s cyber defenses. Poland has been the target of a series of suspected Russian-orchestrated hacks, including attacks on energy and water providers that exploited weak security practices. While Szczurowski and Kruczek stressed their mission was patriotic—to make the Polish internet safer—their work highlights how easily persistent, mundane technical debt can become a national security vulnerability.

Systemic Issues: Outdated CMS and the Absence of Vulnerability Reporting Channels

Outdated Software as a National Risk

The researchers’ most alarming single finding—authentication-free access to hundreds of sites—traces directly to a piece of software that its own vendor had declared “end of life.” Hundreds of public bodies were still running Pad CMS without any prospect of official patches. This is not a rare oversight; it reflects a pervasive public-sector habit of deferring technology refreshes long past the point of safety. When a content management system reaches that stage, every unpatched vulnerability becomes a permanent backdoor, and the cost of remediation shifts from a small update to an expensive emergency rebuild.

The Missing Link: Bug Bounties and Vendor Responsiveness

Beyond outdated code, the research exposes a cultural gap in Poland’s approach to vulnerability disclosure. Many public bodies lack even the simplest route for outsiders to report a security flaw—no published contact, no bug bounty program, and no legal safe harbor for researchers. When Szczurowski and Kruczek did attempt to notify affected vendors, they encountered what they described as dismissive responses; some software makers characterized the bugs as mere “inconveniences” rather than critical security defects. Until Polish authorities mandate both a responsible disclosure framework and procurement clauses that hold vendors accountable for security throughout a product’s lifespan, the same cycle will repeat.

A Warning in a Tense Cyber Environment

The discovery lands in a geopolitical context that magnifies its significance. Poland’s energy and water sectors have already been hit by attacks attributed to Russian state actors, often gaining footholds through precisely the kind of weak cybersecurity identified here. While the researchers did not claim that the newly mapped flaws had been actively exploited in those attacks, the overlap in tactics—opportunistic exploitation of unchecked web portals—reinforces how critical civilian-facing infrastructure can become a staging ground for larger disruption. That courts, airports, and hospitals appear on the vulnerable list means the risk is not hypothetical; it touches services that citizens rely on daily.

What Polish Government IT Needs to Do Now

• Conduct an urgent CMS inventory across all .gov.pl domains and prioritize the replacement or network isolation of any Pad CMS instances that are end-of-life, especially the 300 sites researchers accessed without credentials.
• Secure the judiciary immediately. The two-thirds of Poland’s court websites—roughly 245 separate instances—found to be at high risk should be placed behind enhanced web application firewalls and hardened configurations while permanent patches are sourced or replacements built.
• Establish a national vulnerability disclosure policy that gives white-hat researchers a clear legal channel to report bugs to public bodies, with defined response timelines and a central portal managed by CERT Polska or equivalent authority.
• Mandate vendor accountability in public IT contracts. Procurement rules should require software suppliers to provide a minimum guaranteed support window and clear end-of-life transition plans, so agencies are never left operating unsupported products.
• Launch a pilot public-sector bug bounty program for the most critical citizen-facing services—starting with e-government portals, healthcare booking systems, and airport passenger information sites—to create a financial incentive for finding and fixing flaws before adversaries do.
• Integrate the researchers’ findings into CERT Polska’s proactive scanning. By sharing the full list of affected entities and the technical signatures of the vulnerabilities, the national cyber defense team can notify operators and monitor for exploitation attempts.