www.rmf24.pl Multiple Vulnerabilities Discovered in Płatnik Software
Article Content
- •Three vulnerabilities in Płatnik software disclosed on 2026-10-30.
- •CVE-2026-110972 allows authentication bypass for attackers with client access.
- •Płatnik vulnerabilities have been patched in version 10.02.002.
CERT Polska reported three vulnerabilities in the Płatnik software used by the Social Insurance Institution. CVE-2026-110970 involves the use of unencrypted HTTP for updates, allowing Man-In-The-Middle attacks. CVE-2026-110971 relates to a weak password encoding algorithm, making it easy to decode captured passwords. CVE-2026-110972 allows attackers to bypass authentication if they gain access to any client application instance. These vulnerabilities were patched in version 10.02.002. The issues were disclosed on the same day as the patch release, with acknowledgments to the researcher Wojciech Giełda for reporting two of the vulnerabilities.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (7)
Following this threat?
Track Zakład Ubezpieczeń Społecznych and CVE-2026-110970 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Common questions
What are the CVEs related to Płatnik?
Have these vulnerabilities been exploited?
What should users of Płatnik do?
Continue Reading
Binance Hack: $6.3 Billion Stolen in Largest Crypto Heist On October 29, 2026, Binance, the world's largest cryptocurrency exchange, reported a major security incident involving an estimated $6.3 billion in stolen funds. The attack was attributed to a compromised laptop belonging to a DevOps engineer, allowing unauthorized withdrawal transactions. Approximately $3 billion in… 
China-Linked Hackers Exploit PHP2Shell Vulnerabilities to Breach U.S. Government Systems On October 21, 2026, the PHP development team released patches for two critical vulnerabilities in PHP, known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), which allow unauthenticated remote code execution. These vulnerabilities were actively exploited by a suspected China-linked threat actor who compromised 25…