Gcore waives WAAP fees for public agencies until year-end

Gcore announced on Oct 22, 2026 that its WAAP Enterprise plan will be free for any government body or public agency until Dec 31, 2026. The move follows a wave of php2shell vulnerabilities that knocked out public websites across Europe earlier this week.

The PHP RCE wave that prompted the offer

Two CVEs—CVE-2026-109618 and CVE-2026-109619—were rated CVSS 9.2 and allow unauthenticated remote code execution before any application code runs. The vulnerabilities forced portals in the Netherlands, Finland, Denmark, and France to go offline after CERT-EU and national agencies advised immediate action. Patching large estates can take days, so a filtering layer that blocks the attack pattern lets a site remain online while fixes roll out.

How WAAP keeps sites running

Gcore’s WAAP blocks the php2shell attack path by default for all customers. The service covers domains and websites, custom rules, IP reputation, bot management, threat intelligence, API security, and SIEM integration. Operators can place a site behind the layer, bring it back online, and rely on Gcore to update the rule centrally if new variants appear.

What public-sector operators need to do

Gcore advises all PHP operators to update to 8.5.12, 8.4.27, 8.3.36, or 8.2.35; restart PHP-FPM and long-running workers after updating; and restrict origin access so traffic reaches the server only through a protection layer. PHP 8.1 and older receive no official fix; operators should obtain a vendor backport or upgrade.

How to apply for the free plan

Public-sector organizations can apply with an official government domain. The application process is not detailed in the press release, but the offer is limited to the remainder of 2026.

Commercial value and risk

The free offer gives Gcore a foothold in the public-sector market, where trust and uptime are paramount. By providing a proven protection layer during a vulnerability crisis, Gcore may secure long-term contracts once the free period ends. However, the offer also signals that the company is willing to absorb short-term revenue loss to gain visibility.

What readers should verify

  • Confirm that the government domain is eligible for the free plan.
  • Check that the PHP version in use matches the recommended updates.
  • Ensure that the WAAP layer is correctly positioned to intercept traffic before it reaches the application server.

Open question

Will Gcore extend the free offer beyond 2026 if the php2shell vulnerabilities re-emerge, or will it revert to a paid model? The press release does not address future pricing.

The php2shell incidents highlight the ongoing risk of unpatched PHP code in public-sector deployments. Similar vulnerabilities have previously forced large-scale outages, underscoring the need for proactive application layer protection.

Takeaway for security teams

Deploying a WAAP layer that blocks known attack paths can keep critical services online while patches are applied. Public-sector teams should evaluate whether a vendor-managed protection layer fits their compliance and uptime requirements.

Further reading

For more on how to secure PHP applications, see the Web3 Wallet Drainer Threat Intelligence & Defense Playbook.

  • Web3 Wallet Drainer Threat Intelligence & Defense Playbook
  • Serengeti III arrest: 1,462 arrests and $105M recovered across 21 African nations
  • Cardano ADA Payroll: Navigating Volatility, Tax, and Security

Explore more on this topic

  • More security coverage