Gcore offers free security services to public agencies following PHP vulnerabilities

Gcore has announced it will provide its WAAP Enterprise security plan free of charge to government bodies and public agencies until December 31, 2026. This initiative follows the discovery of php2shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), which carry a CVSS rating of 9.2.

The vulnerabilities allow unauthenticated remote code execution and have forced various public websites, including government portals in the Netherlands, Finland, Denmark, and France, as well as hospitals and schools, to go offline. Gcore’s service is designed to block these attack paths by default, allowing organizations to bring services back online while they undergo the patching process.

Gcore advises all PHP operators to update to specific secure versions, including 8.5.12, 8.4.27, 8.3.36, or 8.2.35, and to restart PHP-FPM and long-running workers after the update. The Enterprise plan includes domain and website protection, custom rules, IP reputation, bot management, threat intelligence, API security, and SIEM integration.