Poland's public infrastructure faces massive cyber vulnerabilities

Polish security researchers Robert Kruczek and Kamil Szczurowski have identified massive vulnerabilities within Poland's public internet infrastructure. Presenting their findings at the Def Con conference in Las Vegas, the researchers revealed that approximately 250,000 websites belonging to over 10,000 public entities are susceptible to cyberattacks.

Critical sectors are notably exposed, including hospitals, airports, and government offices. The researchers highlighted specific risks within the judicial system, noting that the websites of approximately 245 courts—representing nearly two-thirds of the country's judiciary—were accessible due to these flaws.

A primary cause of these vulnerabilities is the use of obsolete software. Specifically, the researchers found that the Pad CMS platform, used by many public institutions, allowed unauthorized access to over 300 official websites without requiring a password. This was attributed to the software having reached its "end of life" and no longer receiving security updates. The researchers cited a lack of bug bounty programs and vendor negligence as contributing factors to the systemic risk.