Gcore Offers Free WAAP Enterprise Plan to Public Agencies Until 2026

CONTERN, Luxembourg, Oct. 22, 2026 /CourierPR/ -- Gcore, a leading-edge platform provider of AI, cloud, network, and security solutions, has announced a significant initiative to bolster the cybersecurity of public agencies. The company is offering its WAAP Enterprise plan free of charge to any government body or public agency until December 31, 2026. This move comes in the wake of recent php2shell vulnerabilities that have forced public websites offline across Europe earlier this week.

The WAAP Enterprise plan, which Gcore’s security solution covers, includes domains and websites, custom rules, IP reputation, bot management, threat intelligence, API security, and SIEM integration. This comprehensive package is designed to protect against the php2shell attacks, which are rated CVSS 9.2 and allow unauthenticated remote code execution before any application code runs. Government portals in the Netherlands, Finland, Denmark, and France, along with hospitals, schools, and commercial sites, were affected by these vulnerabilities, as advised by CERT-EU and national agencies.

Gcore’s WAAP blocks the php2shell attack path by default for all customers. Sites taken offline can be placed behind the service and brought back online while patching continues. If new variants of the vulnerability appear, Gcore updates the rule centrally, and operators do not need to repeat the patching cycle. The company advises all PHP operators to update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, restart PHP-FPM and long-running workers after updating, and restrict origin access so traffic reaches the server only through a protection layer. PHP 8.1 and older versions receive no official fix; operators should obtain a vendor backport or upgrade.

This initiative underscores Gcore’s commitment to supporting public agencies in maintaining robust cybersecurity measures. By providing this free service, Gcore aims to help organizations mitigate the risks associated with the php2shell vulnerabilities and ensure the continued availability of critical services. The WAAP Enterprise plan covers domains and websites, custom rules, IP reputation, bot management, threat intelligence, API security, and SIEM integration. Public-sector organizations can apply here with an official government domain.

Gcore’s WAAP blocks the php2shell attack path (CVE-2026-109618 and CVE-2026-109619) by default for all customers. Sites taken offline can be placed behind the service and brought back online while patching continues. If new variants appear, Gcore updates the rule centrally and operators do not need to repeat the patching cycle. The two PHP vulnerabilities, rated CVSS 9.2, allow unauthenticated remote code execution before any application code runs. Government portals in the Netherlands, Finland, Denmark, and France, along with hospitals, schools, and commercial sites, were taken offline this week on the advice of CERT-EU and national agencies.

Going offline was the right call while no fix existed. Patching large estates takes days. A filtering layer that blocks the attack pattern lets a site run while that work is done. If new variants appear, Gcore updates the rule centrally and operators do not need to repeat the patching cycle. Gcore advises all PHP operators to update to 8.5.12, 8.4.27, 8.3.36, or 8.2.35; restart PHP-FPM and long-running workers after updating; and restrict origin access so traffic reaches the server only through a protection layer. PHP 8.1 and older receive no official fix; operators should obtain a vendor backport or upgrade.