Researchers find over 10,000 Polish public entities exposed to cyberattacks
Two Polish security researchers presented findings at Def Con showing roughly 250,000 websites belonging to courts, hospitals, airports and other public bodies contain exploitable security flaws. Outdated software and a lack of bug-reporting channels left many vulnerabilities unaddressed for a long time.
At the Def Con cybersecurity conference in Las Vegas, Polish researchers Robert Kruczek and Kamil Szczurowski shared results of an extensive review of their country's public-sector internet presence, driven by a wish to make Poland's digital infrastructure safer.
The pair identified more than 10,000 affected public entities, tied to roughly 250,000 websites containing security weaknesses. Among the impacted organizations were airports, hospitals and various government offices.
Outdated systems and dismissed warnings
A major factor behind the exposure, according to the researchers, was outdated or unsupported vendor software combined with the absence of bug bounty programs and clear channels for reporting vulnerabilities. Some flaws were described as easy to exploit, yet certain vendors treated the researchers' disclosures as mere inconveniences rather than serious risks.
The researchers uncovered critical vulnerabilities in a widely used content management system called Pad CMS, which let them access more than 300 public websites without a password. The vendor never patched the issue because the software had reached end-of-life status and was no longer supported. A separate bug granted access to roughly two-thirds of Poland's judiciary, affecting about 245 court websites.
The findings arrive as Poland works to strengthen its cyber defenses following a series of suspected Russian-linked attacks against the country's energy and water providers, some of which exploited weak cybersecurity practices.
Kruczek and Szczurowski reported their discoveries to the government through official channels. They said during their talk that the effort had been worthwhile, noting that as a result, things are now a little bit safer.
