Gcore offers free web security to public agencies after PHP exploit wave
Gcore is making its WAAP Enterprise plan available at no cost to government bodies and public agencies through December 31, 2026, following php2shell vulnerabilities that forced public websites offline across Europe. The service blocks the attack path by default and can keep sites online while patching continues. Gcore also advises PHP operators to update to supported versions and restrict origin access.
Gcore is waiving fees for its WAAP Enterprise package for government and public-sector users through 31 December 2026. The move follows php2shell flaws that took public-facing sites offline in several European countries. The service blocks the two tracked attack routes by default and can shield a site while administrators patch.
The flaws are rated 9.2 and can let an unauthenticated attacker execute code remotely before application logic runs. Gcore recommends PHP releases 8.5.12, 8.4.27, 8.3.36, or 8.2.35, followed by restarts of PHP-FPM and persistent workers, plus limits on origin access. No official remedy exists for PHP 8.1 or older.
The offer may reduce immediate disruption for residents relying on government portals, hospitals, schools, and other public services during a critical patching window. Smaller agencies with limited security staff could benefit most, as a managed filtering layer may buy time without forcing prolonged outages. However, free access through 2026 could create dependency or uneven protection after the period ends; organizations still need patching and origin controls to limit exposure.