GCORE has announced that its WAAP Enterprise plan will be free for public agencies and government bodies until 31 December 2026. The move follows the php2shell vulnerabilities that disrupted public websites across Europe earlier in the week. Gcore states that its WAAP service blocks the attack path by default for all customers, enabling sites taken offline to be brought back online behind the protection layer while patching continues.
The two PHP flaws, CVE-2026-109618 and CVE-2026-109619, are rated CVSS 9.2 and allow unauthenticated remote code execution before application code runs. Government portals in the Netherlands, Finland, Denmark, and France—and also hospitals, schools, and commercial sites—were affected earlier this week on advice from CERT-EU and national cyber authorities.
Gcore describes its Enterprise plan as covering domains and websites, custom rules, IP reputation, bot management, threat intelligence, API security, and SIEM integration. Public-sector organisations can apply for the offer using an official government domain. The company also urges PHP operators to upgrade to PHP versions 8.5.12, 8.4.27, 8.3.36, or 8.2.35; to restart PHP-FPM and long-running workers after updating; and to restrict origin access so traffic reaches the server only through a protection layer. PHP 8.1 and older versions have no official fix, according to Gcore, so operators should obtain a vendor backport or upgrade.