Def Con: Researchers Find Exploitable Web Flaws Across 10,000 Polish Public Entities

At Def Con on August 7, 2026, researchers Kruczek and Szczurowski reported that over 10,000 Polish public entities and 250,000 websites — including airports, hospitals, courts, and government offices — carry exploitable flaws. One bug exposed roughly two-thirds of Poland's judiciary sites. An end-of-life CMS, CVE-2025-7063, left 300 sites with no patch path. No statutory penetration-testing requirement exists.