Gcore is providing its WAAP Enterprise security plan free of charge to government bodies and public agencies until December 31, 2026. The move comes after serious PHP software vulnerabilities caused public websites to go offline in several European countries. The offer is intended to help public organizations strengthen website security and restore online services while technical teams work on necessary software updates.
Gcore Responds to Security Risks Affecting Public Websites
The announcement was made on October 22, 2026, following concerns about two vulnerabilities known as php2shell. Identified as CVE-2026-109618 and CVE-2026-109619, the flaws can allow attackers to execute code remotely without authentication. Both vulnerabilities received a severity score of 9.2 out of 10, indicating a critical security risk.
Government portals in the Netherlands, Finland, Denmark, and France were among the websites reportedly taken offline as a precaution. Hospitals, schools, and commercial organizations were also affected by the wider response to the security threat.
Temporarily disabling a vulnerable website can reduce immediate exposure, but it may interrupt important public services. Gcore’s offer provides eligible agencies with another option: placing websites behind a security filtering service while administrators install patches and check their systems.
What Is Included in Gcore’s Enterprise Security Plan?
The WAAP Enterprise plan combines website, web application, and API protection tools. According to the announcement, the package includes several features designed to help organizations manage online threats.
Key features include:
- Website and domain protection: Helps secure multiple websites and domains.
- Custom security rules: Allows teams to apply protection settings suited to their requirements.
- IP reputation: Helps identify potentially suspicious internet traffic.
- Bot management: Supports the detection and control of automated requests.
- Threat intelligence: Provides security information to support threat monitoring.
- API security: Helps protect the interfaces used by websites and software applications.
- SIEM integration: Allows security-related information to be incorporated into monitoring systems.
These capabilities form part of Gcore services designed to support organizations that depend on reliable digital infrastructure.
How Gcore DDoS Protection Supports Website Security
Distributed denial-of-service attacks, commonly known as DDoS attacks, aim to overwhelm websites or online systems with excessive traffic. Gcore DDoS protection addresses this type of threat, while its WAAP Enterprise offering focuses on web applications and APIs.
Although these services address different security risks, both can contribute to a broader protection strategy. Filtering suspicious requests before they reach an application can help reduce exposure to certain attacks and support service availability.
Gcore states that its WAAP service blocks the identified php2shell attack path by default. However, agencies should not treat security filtering as a replacement for software updates. Administrators still need to install the relevant PHP fixes, restart affected services, and review access to their origin servers.
What Public Agencies in the Netherlands Should Know
The offer may be particularly relevant to organizations in the Netherlands, where government portals were among the services reportedly affected by the incident.
Organizations searching for Gcore Nederland can explore the company’s security offerings and determine whether the free enterprise plan suits their requirements. According to the announcement, public-sector organizations can apply using an official government domain, with the offer running until December 31, 2026. Eligible agencies should confirm the current terms directly with Gcore.
For professionals following Gcore security developments, the announcement highlights the importance of combining protective services with timely vulnerability management. Organizations interested in Gcore events and other company updates can also follow official channels for further information about its technology and security services.
Supporting More Resilient Public Digital Services
Government websites play an important role in providing information and access to essential services. When these platforms become unavailable, residents and businesses may struggle to complete routine tasks or find important updates.
Gcore’s temporary offer gives eligible public agencies an additional security option during the response to the PHP vulnerabilities. Still, effective cybersecurity requires more than one product. Regular updates, careful configuration, access controls, and ongoing monitoring remain important for reducing risk.
By combining protective technology with appropriate maintenance, public organizations can work toward restoring services and keeping their websites more resilient against future threats.
Read our latest interview with Luciano Daffarra
