Polish security researchers Robert Kruczek and Kamil Szczurowski presented findings at Def Con in Las Vegas on August 7, 2026, revealing that more than 10,000 public entities and 250,000 websites in Poland carry exploitable security flaws, including those belonging to airports, hospitals, courts, and government offices. TechCrunch

The researchers identified a critical vulnerability in Pad CMS, a widely used content management system for organizing and displaying website content. The flaw, tracked as CVE-2025-7063, allowed unauthenticated access to over 300 public websites. The Pad CMS developer did not issue a patch because the software had reached end-of-life status and was no longer supported. TechCrunch

A separate bug the researchers discovered exposed the websites of approximately 245 courts, representing roughly two-thirds of Poland's judiciary. Kruczek and Szczurowski reported their findings to the Polish government through various official channels. TechCrunch

The researchers attributed the exposure to a combination of buggy software from vendors and the absence of bug bounty programs or structured channels for reporting security flaws, conditions that left Poland's public services vulnerable to hijacks and other attacks. TechCrunch

The findings land against a backdrop of active threats. Poland has been working to strengthen its cyber defenses following a wave of suspected Russian hacks targeting the country's energy and water providers. TechCrunch Russian hackers previously targeted Polish hospitals and a city water supply, causing suspended operations and stolen data. (Financial Times) In February 2026, CISA published an alert on a Poland energy sector cyber incident that highlighted OT and ICS security gaps. (CISA)

The legal framework compounds the technical exposure. Poland has no general legal duty to carry out penetration tests or vulnerability assessments, though UKSC entities undergo regular audits. (ICLG) The political context is similarly fraught: a Polish court previously blocked an inquiry into the prior government's Pegasus spyware abuses. (The Record)

The broader context here is one of systemic rather than incidental failure. An end-of-life CMS with no vendor support path running on hundreds of public-facing sites is not a misconfiguration; it is an architectural debt that no amount of patching can resolve because the patches will never come. When two-thirds of a country's judiciary websites are reachable through a single bug class, the attack surface is concentrated, not distributed, and a single actor could move laterally across institutions that have no shared incident response.

The absence of mandatory penetration testing means the gap Kruczek and Szczurowski identified exists for a structural reason. Without a legal obligation to test, public entities have no compulsion to discover what two independent researchers found through a systematic scan. The UKSC audit regime covers a subset of critical infrastructure, but courts, hospitals, and airports fall outside that scope in practice, leaving them dependent on vendor goodwill and ad-hoc researcher disclosures.

In this author's view, the combination of end-of-life software with no patch path, no bug bounty or disclosure channel, and no statutory requirement for vulnerability assessment creates a failure mode that is predictable and repeatable. The Polish government's efforts to shore up cyber defenses in response to the energy and water sector intrusions address one layer of the problem, but the Def Con findings make clear that the public-facing web layer remains broadly unmonitored.

What Kruczek and Szczurowski demonstrated is that a determined scan, not a sophisticated exploit chain, was sufficient to map a national-scale exposure. The vulnerability classes they found, unauthenticated access and single-bug cross-site reachability, are well understood and routinely addressed in mature security programs. The gap between what is technically known and what is operationally enforced is where the risk actually lives.