Oakshield Book a call
Menu

Fixed scope, fixed price

Pricing

Last updated:

Written authorization before any access, and a signed evidence report at the end. Every price is fixed and published. Book a call and we’ll tell you which one fits, including whether you need us at all. The short version of every service is on Services.

Which one do you need?

Including when you don’t need us at all.

Your situationWhat to doPrice
Your host manages PHP and nobody is asking you for proof Ask your host to confirm in writing, with our email template. You may not need us. Free
You have a developer, you’re on PHP 8.2 or newer, and nobody is asking for proof Do it yourself: the checks your developer can run. Free
You run your own server, or someone wants proof Patch Verification & Compromise Review $590
You need to show patch status over time, to an insurer, customers or management Verification Plan $990 a year
You’re on PHP 8.2 or older and need to know what an upgrade will break EOL Readiness Report from $290
You look after 10 or more client sites Agency Fleet Triage $990 for 10 sites
You run an online store Patch Verification & Compromise Review: server and PHP runtime patch status plus the standard compromise review. Payment-page and skimmer checks are not included. $590

Free guides: how to prove PHP is patched, the PHP 8.2 end-of-life checklist, the agency triage guide and the FAQ.

Every service, with every price

Read-only verification and evidence, from a tested checklist.

What you pay for, compared with updating it yourself
Updating it yourselfWith a Patch Verification
Install the fixYes, if you control PHPChecked, not assumed
Know it’s runningRestart and check each PHP runtime yourselfWorker start times checked for every runtime
CVE-2026-115560Find the right configuration file, set it, restartThe exact setting for your server, verified once it’s applied
Was anyone in before October 21?Not answered by an updateCompromise review from October 17, with its limits listed
Proof for an insurer or customerYour wordA signed per-CVE report, with evidence levels and UTC times

Recommended first step

Patch Verification & Compromise Review

Am I patched, and was I already hit? Answered per CVE, in writing you can forward.

$590
per server, includes 1 site
+$150
per additional site on that server
capped at $1,200
in extra-site charges per server, every server, however many sites
$472
each additional server in the same order (same per-site price and cap)
$590
per server for an online store: server and PHP runtime patch status plus the standard compromise review. Payment-page and skimmer checks are not included.

For example

  • 2 servers with 3 sites each: $1,662
  • 1 server with 12 sites (the cap): $1,790
  • Each additional server with 12 sites (the cap): $1,672
Timeline
Report within 1 business day once read-only access works
Book a call

What you get

  • Per-CVE patch status for every PHP runtime on the server: build string, how it runs, package changelog entries citing the CVEs, worker restart time after patching, and the CVE-2026-115560 setting
  • A compromise review from October 17: PHP2Shell log indicators; processes started by the web server; file and checksum changes; new admin accounts, scheduled tasks and SSH keys
  • A secrets-exposure assessment listing what to rotate if a vulnerable setup ran unpatched
  • A one-page summary for managers or insurers, plus the full evidence report (PDF and JSON)
  • Each finding carries an evidence level and a UTC timestamp. Open issues are listed
  • One free re-check once a fix for CVE-2026-115560 ships: if your report came before the fix, ask within 60 days of its release
  • php.net’s interim setting for CVE-2026-115560, written for your server, and a re-check once your admin applies it

Not included

  • Changes to your server: we verify and report, and your admin applies any fix
  • Payment-page and skimmer checks on online stores
  • Cleanup. If we find indicators, we stop, preserve evidence, notify you within 1 hour, and recommend next steps
  • Penetration testing; endpoints, email or office suites; database forensics
  • Legal or breach-notification advice
  • Any guarantee that you weren’t compromised

Why it matters

It answers the two questions owners actually ask, am I patched and was I already hit, in writing you can forward. Attempts began four days before the patch, and a version number can’t settle either question.

Sources: AlmaLinux, php.net advisory on CVE-2026-115560, October 23, 2026, The Hacker News, BleepingComputer

  • Compromise-review results read “No evidence of compromise found in the checks listed.”, or list what was found.
  • Signed by the Approver of Record.
  • It covers online stores too. Payment-page and skimmer checks are not included.

Verification Plan

Show patch status over time, not once: quarterly re-verification, and a re-check after the next critical PHP flaw.

$990
per server per year, includes 1 site and the first verification
+$150
per additional site on that server, per year
capped at $2,190
per server per year, however many sites

For example

  • 1 server with 3 sites: $1,290
  • 1 server with 9 or more sites (the cap): $2,190
Timeline
Twelve months from the first verification. Targets, not guarantees: quarterly letters within 2 business days of receiving the kit file; event re-check letters within 5 business days of the advisory, if your admin returns the kit file within 3 business days of our request
Book a call

What you get

  • At the start: a full Patch Verification & Compromise Review of the server. The first year includes it. If you bought one for the server in the last 60 days, that report is the baseline and its price is credited in full
  • Months 3, 6 and 9: per-CVE patch status for every PHP runtime, what changed since the last verification, and automated compromise-indicator checks, in a dated one-page evidence letter for your insurer or customers, plus the full table (PDF and JSON)
  • An event re-check after a qualifying advisory: a new PHP vulnerability affecting your server’s PHP branch and rated critical (CVSS 9.0 or higher, critical in php.net’s advisory, or listed in CISA’s Known Exploited Vulnerabilities catalog). The CVE-2026-115560 fix counts as one, whenever it ships
  • Month 12: an annual summary of each runtime’s status across the year and every advisory we re-checked
  • Read-only checks from a tested checklist, through least-privilege access. We change nothing on your server

Not included

  • Any change or fix
  • Cleanup or incident response if we find an indicator: we stop, preserve the evidence and tell you within 1 hour of confirming it
  • The full compromise review between initial verifications: offline snapshot scans, manual log review and process hunting happen only at each year’s initial verification
  • Payment-page and skimmer checks on online stores. Store servers can have the plan
  • Servers or sites not listed at the start (add them at the plan rates)
  • Anything a Patch Verification excludes
  • Any guarantee that the server is or stays uncompromised. Your admin collects the evidence, so a hostile insider or an attacker with root access could falsify it. Off-host binary hashes reduce that risk but can’t remove it

Why it matters

CVE-2026-115560 is still open, so every report has a dated reason to come back. Insurers, customers and managers ask about patch status over time.

Sources: php.net advisory on CVE-2026-115560, October 23, 2026

  • For a Linux server (64-bit Intel/AMD or ARM) that you or your agency run, where your admin can run a script with sudo. Not for shared hosting or managed platforms without a shell.
  • If a quarter’s kit file doesn’t arrive within 30 days, that letter says “Not verified this quarter: evidence not received”.
  • Renewal is opt-in: at month 11 we send the price, and the plan renews only if you confirm. Cancel any time: we refund $133 for each quarterly re-verification not yet delivered.

Agency Fleet Triage

One clear call per client site, with a summary you can forward.

$990
for the 10-site pilot (the minimum order)
$99
per site, sites 1–49
$79
per site, sites 50–199
$59
per site, site 200 and up

For example

  • 10 sites: $990
  • 50 sites: $4,930 ($98.60 a site on average)
  • 200 sites: $16,760 ($83.80 a site on average)
Timeline
Within 2 business days for up to 50 sites, after authorization and access
Book a call

What you get

  • For each client site, a clear call: go, mitigate, patch, or offline until fixed, with the reasons and the evidence level
  • A one-page summary per client, ready to forward
  • A fleet view (CSV and PDF) showing which hosts confirmed patching and which servers are yours to fix
  • The next step for every site that isn’t “go”

Not included

  • Changes to client systems
  • A compromise review (add a Patch Verification for any server at the partner price, $472)
  • Sites whose client authority you can’t show yet

Why it matters

Clients are asking now, and one answer has to cover every site. Many hosts reported patching their managed plans; servers you or your clients run are yours to patch.

Sources: GoDaddy

  • Graduated, like tax brackets: each site is priced by its own band, so a bigger order never costs less than a smaller one.
  • Requires written proof of authority over each client site. Every end client signs our authorization form.

EOL Readiness Report

Will your site run on PHP 8.4, and what will the move take?

$290
per CMS site (WordPress, Magento, Drupal)
$490
per custom PHP app
+$190
per additional site in the same order
$190
when added to a Patch Verification for the same site

For example

  • A custom app plus a CMS site (the custom app counts first): $680
Timeline
2 business days after read-only access
Book a call

What you get

  • A read-only compatibility verdict for PHP 8.4 covering code, theme, plugins and extensions
  • The blockers we found, and whether your host offers 8.4 or 8.5
  • What the move involves, so you or your developer can plan and price it

Not included

  • The upgrade itself
  • Database copies (only with a data-processing agreement, if you want one)
  • Performance or feature review

Why it matters

PHP 8.2 stops receiving security fixes on December 31, 2026. You’ll know what the move involves before you commit.

Sources: php.net supported versions

  • The first site in an order is always the highest-priced one.

Partners: agencies, hosts, MSPs

How fleet triage works

  • Agency Fleet Triage, graduated (sites 1–49 / 50–199 / 200+)$99 / $79 / $59 per site; $990 for the 10-site pilot; no partner discount on top
  • Patch Verification for flagged sites$472 per server, every server, +$120 per extra site, capped at $1,432 per server (20% off)
  • EOL Readiness Report$232 per CMS site / $392 per custom app (20% off)
  • Verification Plan$792 per server per year, +$120 per extra site (20% off)
  • ReportsCo-branded

The partner discount is at most 20%, and only on fixed-price single-client jobs: Patch Verification, the EOL Readiness Report and the Verification Plan. It never stacks on the graduated Fleet prices, which are already wholesale.

Every end client signs our authorization form.

Talk to us about partnering

How every job works

Before we start

A signed authorization names exactly which servers and sites are in scope. Your firewall, CDN, backup and hosting accounts stay in your name.

While we work

Read-only checks from a tested checklist, through least-privilege access. We change nothing on your server. Anything off the checklist stops and comes back to you. We never run exploits.

Who signs

A named person at Oakshield, the Approver of Record, reviews every finding and signs your report.

What we don’t promise

No one can guarantee a site won’t be hacked. Compromise reviews read “No evidence of compromise found in the checks listed.” and list the checks and their limits, because, as PHP’s advisory warns, “absence of an error in logs is not proof of safety.”

Your website, accounted for.

Not sure which one you need?

Tell us your setup and we’ll tell you, including whether you need us at all.

Book a call Check it yourself, free

Sources

Every figure and quotation on this page links to its primary source. All of them, with the date we last checked each: full wording and methods.