Hackers Didn’t Break Into Poland. They Just Knocked.

Two Polish security researchers decided, out of patriotism and a desire to make it safer for everyone, to scan their country’s public internet. They weren’t launching attacks. They were checking whether the doors were locked. What they found was unsettling: more than 10,000 public entities and 250,000 websites with security flaws — including courts, hospitals, and airports.

Now, before you file that under “European news,” think about your own business for a second.

When did you last update the software behind your website? When did you last check whether the company that built your booking system is even still in business? If you’re like most Malaysian business owners, the honest answer is “I don’t know” or “I don’t remember.” And that’s precisely the problem.

TL;DR

• Researchers scanned Poland’s public web and found 250,000 vulnerable sites and 10,000 exposed agencies.
• Most ran abandoned, “end-of-life” software — one bug alone gave access to 245 courts.
• The same conditions exist in Malaysian SMEs: neglected websites, unpatched systems, and nobody assigned to check. You can fix it with a simple maintenance habit.

What This Means: A Door That Never Gets Locked

Let’s translate what actually happened into plain language. Everything on the internet — websites, booking systems, customer portals — runs on software. That software is written, maintained, and repaired by developers. When a developer stops supporting a product, it becomes “end of life.” It still runs, but nobody is fixing its security holes anymore. Publicly, that means it becomes a door that silently drifts open.

The researchers, Robert Kruczek and Kamil Szczurowski, presented their findings at the Def Con cybersecurity conference in Las Vegas. They found critical flaws in Pad CMS, an older content management system, that let them walk into over 300 public websites without even needing a password. That’s the equivalent of hundreds of government offices sharing the same key — and the lock was rusted open.

Another single bug exposed 245 court websites — roughly two-thirds of Poland’s judiciary. And when they reported these flaws, some software vendors shrugged, describing the bug reports as “inconveniences.” No urgent patch. No acknowledgment. Not even a “thanks, we’ll take a look.”

This isn’t a story about sophisticated, state-sponsored cyber warfare. It’s a story about neglected maintenance at a national scale.

How This Applies to Malaysian SMEs

Here’s the uncomfortable truth: your business probably has the same problem in miniature.

Think about your website. You had it built a few years ago by an agency, a freelancer, or a well-meaning relative. They handed you the keys and moved on. When was the last WordPress update? The last plugin update? For many Malaysian SMEs, the answer is “since the day it went live.” Your website could have the digital equivalent of a broken window right now — you just haven’t discovered it yet.

Now consider everything else that touches your customers’ information. The clinic in Petaling Jaya running a booking system on software nobody maintains. The logistics company in Johor with a customer portal that hasn’t been touched in years. The e-commerce shop in Penang using plugins abandoned by their makers. Once a bug becomes public, it’s trivially easy for anyone to exploit — and attackers scan for these flaws automatically, around the clock, worldwide. Your business doesn’t need to be a target to be found. It just needs to be in reach.

Malaysia is home to more than a million SMEs, and most owners carry the full weight of IT on their own shoulders. No security team. No IT department. Just you, a business to run, and a website you assume is fine. But the Polish research shows that even government agencies with budgets and mandates end up badly exposed when nobody is explicitly in charge of checking. A court can absorb a breach and keep operating. Your revenue and reputation are far less forgiving.

The Polish researchers didn’t break into anything — they just checked what was already unlocked. In cybersecurity, that’s all a hacker needs to do too, and their scans are running right now.

Practical Takeaways: Your Monthly Security Habit

You don’t need a cybersecurity degree. You need a routine. Here’s a checklist you can start using this week:

• Know what you run. List every piece of software your business depends on: website CMS, plugins, booking system, accounting tools, even the office router. Write them all down.
• Check for “end of life.” Search each product name followed by “end of life.” If your software shows up, plan a replacement instead of waiting for the first breach.
• Update monthly. Set a recurring reminder to update your CMS, plugins, and anything connected to customer data. Thirty minutes a month.
• Keep your developer close. If someone built your site, make sure you have an active contact and a maintenance arrangement. Vanishing developers are a security risk.
• Back everything up. An automated backup of your website and databases turns an attack into an inconvenience instead of a shutdown.
• Know who to call. Have a local IT person or security contact ready if something looks wrong. Don’t go hunting for help after the damage is done.

The Bigger Picture

Poland is a sovereign government, a NATO member, actively shoring up its cyber defenses after a wave of suspected Russian attacks on its energy and water providers. And its public web is still soaked in easily exploitable flaws. The gap between what we believe is protected and what is actually protected is not shrinking.

That gap will hit small businesses hardest. Large organizations can hire security teams and run continuous scans. For an SME, the default posture is usually “hope” — hope the website works, hope the data is safe, hope nobody pokes at the old booking system. This research is proof that hope isn’t a strategy. But it also carries a reassurance: none of this demands advanced technical skill. It takes attention, a checklist, and the discipline to follow it.

The researchers ended their Def Con talk with a modest conclusion. As a result of their work, they said, “we are a little bit more safe.” That’s the bar. Not invincibility — just a little bit more safe, achieved one update, one check, one habit at a time. You can start on that today.

What One Scan Found

Finding	Scale
Public entities at risk	10,000+
Websites with security flaws	250,000
Courts exposed by a single bug	245 (about two-thirds of Poland’s judiciary)
Public websites accessible without a password	300+ (via an abandoned CMS)

All figures from the researchers’ Def Con presentation, as reported by TechCrunch.

Ready to Streamline Your Operations?

Your business should run itself. AutoRunBiz deploys AI agents to automate your daily operations — WhatsApp orders, invoicing, customer follow-ups, and accounting. Book a free 15-min ops audit to see where automation fits your business →