Cybersecurity regulations and vulnerabilities impact Polish organizations

New cybersecurity regulations are shifting legal responsibility directly onto corporate boards. Under frameworks such as the NIS2 implementation via the KSC Act, DORA, and the Cyber Resilience Act (CRA), management can face significant penalties for organizational negligence. Potential fines include up to 10 million euros or 2% of turnover under the KSC Act, and up to 15 million euros or 2.5% of turnover under the CRA. These laws emphasize that cybersecurity is no longer solely an IT issue but a matter of compliance, legal risk, and executive oversight.

In a separate technical development, critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) were detected in PHP software, a technology used by approximately 70% of websites globally. The Polish CERT issued warnings to mitigate these risks. In response, several services, including some government websites, were temporarily taken offline to implement security patches. Systems like V-Desk, which rely on PHP, have implemented these official security updates to protect against exploitation.