Gcore is offering its WAAP Enterprise plan free of charge to any government body or public agency until December 31, 2026. The offer follows the php2shell vulnerabilities that forced public websites offline across Europe earlier this week.
Gcore WAAP blocks the php2shell attack path (CVE-2026-109618 and CVE-2026-109619) by default for all customers. Sites taken offline can be placed behind the service and brought back online while patching continues. The two PHP vulnerabilities, rated CVSS 9.2, allow unauthenticated remote code execution before any application code runs. Government portals in the Netherlands, Finland, Denmark, and France, along with hospitals, schools, and commercial sites, were taken offline this week on the advice of CERT-EU and national agencies.
Also Read: CIO Influence Interview with John Elliott, Cybersecurity Author Fellow at Pluralsight
Going offline was the right call while no fix existed. Patching large estates takes days. A filtering layer that blocks the attack pattern lets a site run while that work is done. If new variants appear, Gcore updates the rule centrally and operators do not need to repeat the patching cycle.
Gcore’s Enterprise plan covers domains and websites, custom rules, IP reputation, bot management, threat intelligence, API security, and SIEM integration. Public-sector organizations can apply here with an official government domain.
Gcore advises all PHP operators to update to 8.5.12, 8.4.27, 8.3.36, or 8.2.35; restart PHP-FPM and long-running workers after updating; and restrict origin access so traffic reaches the server only through a protection layer. PHP 8.1 and older receive no official fix; operators should obtain a vendor backport or upgrade.
Catch more CIO Insights: How Are CIOs Aligning Technology with Workforce Agility?
[To share your insights with us, please write to psen@itechseries.com ]
