Contern, Luxembourg, October 22nd, 2026—In a significant initiative, Gcore is now offering its WAAP Enterprise plan at no cost to government bodies and public agencies until the end of December 2026. This decision comes in response to recent php2shell vulnerabilities that resulted in the shutdown of numerous public websites across Europe earlier this week.
Security Measures Against php2shell Vulnerabilities
Gcore’s WAAP Enterprise plan is equipped to thwart the php2shell attack routes (CVE-2026-109618 and CVE-2026-109619) by default, ensuring that affected websites can be restored online while necessary patches are being implemented. These PHP vulnerabilities, which have been assigned a CVSS score of 9.2, allow unauthorized remote code execution prior to the execution of any application code.
In the wake of these vulnerabilities, government portals in nations such as the Netherlands, Finland, Denmark, and France, as well as hospitals, schools, and commercial websites, were advised to go offline by CERT-EU and national agencies. This preventive measure was deemed essential due to the absence of an immediate fix, as patching large systems can take several days.
Benefits of Gcore’s Enterprise Plan
The Gcore Enterprise plan encompasses a comprehensive suite of security features, including domain and website protection, custom rules, IP reputation management, bot management, threat intelligence, API security, and SIEM integration. Public sector organizations interested in availing of this offer must apply using an official government domain.
In the event of emerging attack variants, Gcore provides centralized rule updates, allowing operators to maintain security without undergoing repetitive patching cycles, thus ensuring the continuity of critical digital services.
Guidance for PHP Operators
Gcore advises all PHP operators to update to versions 8.5.12, 8.4.27, 8.3.36, or 8.2.35, and to restart PHP-FPM along with any long-running workers post-update. Additionally, it is recommended to restrict origin access so that traffic reaches the server exclusively through a protection layer. For PHP 8.1 and older versions, which do not receive official fixes, operators are encouraged to seek vendor backports or upgrade promptly.
Gcore’s commitment to enhancing global digital security is evident through its initiatives, which not only safeguard public sector websites but also support businesses worldwide in delivering fast, secure, and seamless user experiences. For further information, visit www.gcore.com and follow Gcore on LinkedIn, X, YouTube, and Facebook.
