Oakshield Book a call
Menu

The process is the product

How we work

Last updated:

Every engagement follows the same steps, and every step is recorded in your report.

Every engagement, step by step

Each step shows who does it.

  1. Authorize

    You

    You sign an authorization naming exactly which servers and sites are in scope. Nothing happens without it.

  2. Inventory

    Our delivery system

    Every PHP runtime, how it runs, the CMS, plugins and dependencies, on authorized systems only.

  3. Verify

    Our delivery system

    Patch status per CVE, from packages and configuration, never from the version string alone. We never run exploits.

  4. Review

    Approver of Record

    A named person at Oakshield, the Approver of Record, reviews every finding and signs your report. Every review is logged in your report.

  5. Report

    Approver of Record

    A signed evidence report with per-CVE status, evidence levels, UTC timestamps, open issues and the approval log.

Evidence levels

A version number doesn’t establish patch status, so every status in a report says how we know it.

LevelNameMeaning
1Runtime-verifiedConfirmed on the running PHP process, for example worker start times after the package install, or a live configuration value.
2Package-verifiedThe installed package’s changelog or manifest cites the fix, but the running processes weren’t confirmed.
3Host-attestedThe host confirmed it in writing (status page or ticket). We couldn’t inspect the server.
4External indicators onlyWhat the internet can see. All the free check can ever give you, and not proof either way.

Every report also lists known open issues. As of October 23, 2026, that always includes CVE-2026-115560, which no PHP release fixes yet. That’s why we never say “fully patched”.

Who approves what

YouApprover of RecordOur delivery system
What’s in scope Approves (signed authorization) — Enforces it; refuses anything else
Access Grants least privilege, and removes it at the end — Uses it read-only
The report Receives it Reviews and signs Drafts it from structured findings

Names appear on your own report, never in our marketing.

A Patch Verification, start to finish

Patch Verification & Compromise Review: one business day from working access to signed report.

StepWhat happensWhoTypical time
Order and authorize Someone with authority signs a short authorization that lists exactly what we may touch. You 10 minutes
Read-only access A dedicated, least-privilege login, shared through a secure link. Your admin 15 minutes
Collection and checks Every PHP runtime, patch status per CVE, then the compromise review from October 17. Our delivery system (read-only) A few hours
Interim setting php.net’s CVE-2026-115560 setting, written for your server. We re-check it once it’s applied. Your admin 10 minutes
Review and signature Every finding reviewed; the report signed. Approver of Record Same day
Report delivered A one-page summary plus the full evidence report (PDF and JSON). Oakshield 1 business day after access works
Close-out You remove our access; we confirm in writing. Working copies are deleted after 30 days. You + Oakshield 5 minutes

Method: patch, shield, harden, modernize

In that order. The fastest reduction in risk is rarely a rewrite.

  1. Patch

    Move the PHP runtime to a fixed release or a vendor backport, restart it, and apply the CVE-2026-115560 setting. Verify from the package, not the version string.

  2. Shield

    Firewall rules and virtual patches in your own account, to cover the gap until a fix exists. Patchstack, a WordPress security vendor, found that 46% of WordPress-ecosystem vulnerabilities in 2025 had no fix at disclosure. A shield buys time; it doesn’t replace the patch.

  3. Harden

    Move away from the highest-risk Apache mod_php setup where practical. Rotate secrets that may have been exposed. Restrict admin access, and keep off-server backups you have restored at least once.

  4. Modernize

    Move to PHP 8.4 or 8.5 (supported to December 2028 and December 2029) and replace abandoned plugins. Rewrite only when the business case stands on its own; other stacks need patching too.

What we do, and what we don’t

We doWe don’t
Work only on systems you authorize in writingScan, probe or test anything we’re not authorized to touch
Report per CVE, with evidence levels and open issuesSay “vulnerable”, “safe” or “fully patched”
Name the Approver of Record on your reportLet AI tools make changes on their own
Stop and ask when a step is off the checklistImprovise on production systems
Recommend the smallest change that closes the riskPush rewrites you don’t need
Respond when you contact usContact anyone because their site went down or made the news
Publish prices and re-quote in writing if scope growsSend surprise invoices

How we use AI

AI-assisted tooling does the repetitive work under strict data controls: inventory, log triage and report drafting. The AI tools we use never hold credentials to your systems. Changes run only through our approval-locked pipeline, after a named person approves them, except standard changes pre-approved in your contract.

No single automated agent combines untrusted input, access to sensitive systems and the ability to make changes (the “Agents Rule of Two”). Our free check uses no AI at all, because the pages it reads are untrusted.

Capacity: we start a limited number of engagements each week so every finding gets a full review, and we give you a real start time.

Your website, accounted for.

Read the report before you buy.

The sample shows every section you’ll receive, from the per-CVE table to the approval log.

Read the sample report Services and prices

Sources

Every figure and quotation on this page links to its primary source. All of them, with the date we last checked each: full wording and methods.