Polish security researchers Robert Kruczek and Kamil Szczurowski presented findings at Def Con in Las Vegas on August 7, 2026, revealing that more than 10,000 public entities and 250,000 websites in Poland carry exploitable security flaws. The affected sites belong to airports, hospitals, courts, and government offices. TechCrunch

The researchers identified a critical vulnerability in Pad CMS, a widely used content management system — the software that lets organizations organize and display website content without coding each page by hand. The flaw, tracked as CVE-2025-7063, allowed anyone to access over 300 public websites without a username or password. The Pad CMS developer did not issue a patch because the software had reached end-of-life status, meaning it was no longer maintained or supported. TechCrunch

A separate bug the researchers discovered exposed the websites of approximately 245 courts, representing roughly two-thirds of Poland's judiciary. Kruczek and Szczurowski reported their findings to the Polish government through various official channels. TechCrunch

The researchers attributed the exposure to a combination of buggy software from vendors and the absence of bug bounty programs or structured channels for reporting security flaws. Bug bounties are programs where organizations pay outside researchers to find and report vulnerabilities before malicious actors can exploit them. Without these programs, Poland's public services were left vulnerable to hijacks and other attacks. TechCrunch

The findings land against a backdrop of active threats. Poland has been working to strengthen its cyber defenses following a wave of suspected Russian hacks targeting the country's energy and water providers. TechCrunch Russian hackers previously targeted Polish hospitals and a city water supply, causing suspended operations and stolen data. (Financial Times) In February 2026, CISA published an alert on a Poland energy sector cyber incident that highlighted gaps in the security of operational technology and industrial control systems — the specialized computers that run physical infrastructure like power grids. (CISA)

The legal framework compounds the technical exposure. Poland has no general legal duty to carry out penetration tests — simulated attacks designed to uncover vulnerabilities — or vulnerability assessments, though UKSC entities (entities designated as critical infrastructure operators) undergo regular audits. (ICLG) The political context is similarly fraught: a Polish court previously blocked an inquiry into the prior government's Pegasus spyware abuses. (The Record)

The broader context here is one of systemic rather than incidental failure. An end-of-life CMS with no vendor support path running on hundreds of public-facing sites is not a misconfiguration; it is an architectural debt that no amount of patching can resolve because the patches will never come. When two-thirds of a country's judiciary websites are reachable through a single bug class, the attack surface is concentrated, not distributed, and a single actor could move laterally across institutions that have no shared incident response.

The absence of mandatory penetration testing means the gap Kruczek and Szczurowski identified exists for a structural reason. Without a legal obligation to test, public entities have no compulsion to discover what two independent researchers found through a systematic scan. The UKSC audit regime covers a subset of critical infrastructure, but courts, hospitals, and airports fall outside that scope in practice, leaving them dependent on vendor goodwill and ad-hoc researcher disclosures.

In this author's view, the combination of end-of-life software with no patch path, no bug bounty or disclosure channel, and no statutory requirement for vulnerability assessment creates a failure mode that is predictable and repeatable. The Polish government's efforts to shore up cyber defenses in response to the energy and water sector intrusions address one layer of the problem, but the Def Con findings make clear that the public-facing web layer remains broadly unmonitored.

What Kruczek and Szczurowski showed is that a determined scan, not a sophisticated exploit chain, was sufficient to map a national-scale exposure. The vulnerability classes they found — unauthenticated access and single-bug cross-site reachability — are well understood and routinely addressed in mature security programs. The gap between what is technically known and what is operationally enforced is where the risk actually lives.