Gcore Makes WAAP Enterprise Plan Free for Public Agencies Until December 31, 2026

Gcore is offering its WAAP Enterprise plan free of charge to any government body or public agency until December 31, 2026, the company said. The offer follows php2shell vulnerabilities that forced public websites offline across Europe earlier this week, according to TechStartups.

What the WAAP Enterprise Plan Covers

Gcore WAAP blocks the php2shell attack path, tracked as CVE-2026-109618 and CVE-2026-109619, by default for all customers. Sites taken offline can be placed behind the service and brought back online while patching continues. The two PHP vulnerabilities, rated CVSS 9.2, allow unauthenticated remote code execution before any application code runs.

Government portals in the Netherlands, Finland, Denmark, and France, along with hospitals, schools, and commercial sites, were taken offline this week on the advice of CERT-EU and national agencies. Gcore said going offline was the right call while no fix existed, and that patching large estates takes days. A filtering layer that blocks the attack pattern lets a site run while that work is done. If new variants appear, Gcore updates the rule centrally and operators do not need to repeat the patching cycle.

The Enterprise plan covers domains and websites, custom rules, IP reputation, bot management, threat intelligence, API security, and SIEM integration. Public-sector organizations can apply with an official government domain. Gcore advises all PHP operators to update to 8.5.12, 8.4.27, 8.3.36, or 8.2.35; restart PHP-FPM and long-running workers after updating; and restrict origin access so traffic reaches the server only through a protection layer. PHP 8.1 and older receive no official fix; operators should obtain a vendor backport or upgrade.

Gcore's Security and AI Infrastructure Record

Gcore is a Luxembourg-based edge AI, cloud, network, and security infrastructure provider operating 210+ points of presence across six continents, according to akta.pro company records. The company serves enterprises in gaming, media, AI/ML, and telecommunications with GPU cloud, CDN, DDoS protection, and WAAP solutions. Gcore was founded in 2014 and is headquartered in Contern, Luxembourg, with a headcount range of 501-1000. Its total funding stands at $60 million from a Series A round in July 2024 led by Constructor Capital and Wargaming.

Earlier Gcore Security and Cloud Deployments

In July 2026, Gcore launched its AI Cloud Stack, a software solution accelerated by NVIDIA GPUs, to help telecommunication providers and enterprises build private AI clouds, Nokia reported. In June 2026, Gcore deployed its Network Layer DDoS Protection for Ucom, one of Armenia's leading telecommunications providers, to safeguard public live broadcast infrastructure during the country's 2026 parliamentary elections, Cyber Security News reported. Also in June 2026, Gcore partnered with Ucom to protect the Armenian telecommunications provider's public live broadcast infrastructure during the same elections, GlobeNewswire reported.

Application Deadline for Public Agencies

Public-sector organizations can apply for the free WAAP Enterprise plan with an official government domain until December 31, 2026, the company said.