Security researchers scanned the Polish web and found courts, hospitals, and airports at risk of hacks

The researchers performed a systematic scan of Poland’s public web presence and identified a massive exposure surface, counting tens of thousands of entities and hundreds of thousands of individual sites. Their methodology revealed that a single, unsupported content-management system was a common denominator across many high-value targets. This concentration means that a single exploit can cascade across a wide range of services, from court portals to airport information pages.

One of the disclosed vulnerabilities allowed direct access to over three hundred public sites without any authentication step, effectively bypassing normal login controls. Another flaw granted entry to the majority of the country’s judiciary web infrastructure, covering roughly 245 courts. Because the Pad CMS has been declared end-of-life, its developers no longer issue patches, leaving the flaw unaddressed by default.

The report also points out systemic issues beyond the code itself: many vendors dismissed the bug reports as minor inconveniences, and there is no organized bounty or reporting framework to incentivize rapid fixes. For engineers, this signals that even when a vulnerability is known, remediation can stall without clear processes and stakeholder buy-in. Implementing a responsible disclosure policy and allocating resources for legacy system migration become essential steps.

Remediation will likely require organizations to replace the outdated CMS with a supported alternative or to apply custom mitigations, which entails development effort, testing, and possible downtime. Additionally, establishing a formal vulnerability disclosure channel may involve legal, operational, and budgeting considerations. Sites that continue to run the unsupported software will remain exposed, as no upstream patches are forthcoming.

Overall, the findings serve as a cautionary example that reliance on legacy third-party software without active maintenance can create a nation-wide attack surface. Engineers must audit their technology stacks for end-of-life components, prioritize updates, and embed security reporting mechanisms to reduce the risk of similar large-scale exposures.