Gcore is providing its WAAP Enterprise plan to government and public agencies at no cost until December 31, 2026. This initiative follows recent php2shell vulnerabilities that caused widespread website outages across Europe.
The service blocks CVE-2026-109618 and CVE-2026-109619, which are rated with a CVSS score of 9.2. These vulnerabilities allow for unauthenticated remote code execution. Affected entities include government portals in the Netherlands, Finland, Denmark, and France, as well as hospitals and schools.
The Enterprise plan includes bot management, threat intelligence, API security, and SIEM integration. Organizations with official government domains are eligible to apply for the offer. Gcore also recommends that PHP operators update to versions 8.5.12, 8.4.27, 8.3.36, or 8.2.35.
For versions 8.1 and older, which lack official patches, the company advises obtaining vendor backports or upgrading. Operators are encouraged to restrict origin access to ensure traffic passes through a protection layer.
