The heart of WordPress, run by someone who never logged in: the WP2Shell chain
WordPress runs a huge share of the public web. Two flaws in its core — a SQL injection in WP_Query (CVE-2026-60137) and a REST API batch-route confusi…
Continue reading →
Topic · Institutions
National cybersecurity
Who defends Italy in cyberspace, with what powers, and within which European framework.
criticalFeatured dossierThe heart of WordPress, run by someone who never logged in: the WP2Shell chainRead the dossier →
Dossiers in this section
4 dossiers
NIS2 in Italy: who is really in scope, since when, and why it reaches suppliers too
Not an attack, but the perimeter within which attacks are managed. The NIS2 directive was transposed in Italy by Legislative Decree 138/2024, in force…
Continue reading →
The thirty-euro router that wiretapped foreign ministries
APT28 turned thousands of home routers into a wiretapping network aimed at foreign ministries and law enforcement, hijacking DNS to steal already-auth…
Continue reading →
Volt Typhoon stopped watching. Now it's looking for the stop button
For five years Volt Typhoon hid inside US critical infrastructure and touched nothing. In 2026 Dragos catches it manipulating engineering workstations…
Continue reading →
The topic in brief
The institutional perimeter
Italy's cybersecurity has a defined architecture. The National Cybersecurity Agency (ACN) is the national authority for cybersecurity: it coordinates strategy, the resilience of essential services, and relations across the public and private ecosystem. Within it operates CSIRT Italia, the national computer security incident response team, which receives reports, issues alerts and bulletins, and supports incident handling.
The European framework: NIS2
The national level plugs into the Union's. The NIS2 Directive (Directive EU 2022/2555) raised the common European bar: it widens scope to eighteen critical sectors, mandates risk-management measures and reporting of significant incidents, and introduces direct accountability of top management. Member States had to transpose it by 17 October 2024. Each State also adopts a national cybersecurity strategy.
Why it matters even if you're not a “critical entity”
NIS2's logic cascades: the obligations of essential operators flow down their supply chain. A company not directly regulated may still have to demonstrate security measures because it supplies one that is. Knowing the institutional perimeter isn't a formality: it defines who to contact during an incident and which obligations apply.
FAQ
- Who is Italy's national cybersecurity authority?
- The National Cybersecurity Agency (ACN), within which CSIRT Italia handles incident response.
- What changes with NIS2?
- It widens the covered sectors, introduces risk-management and reporting obligations, and makes top management accountable for compliance.