Straight answers
What the work includes, how your request is protected, and where human review comes in.
Last updated .
Oruanyi comes from Ọrụ Anyị, meaning “Our Job.” It describes our focus on the work a business needs to get done: its people, systems, approvals and repeated processes. Our promise is “Our Job Delivers Excellence.” We begin by understanding that work before proposing an AI system or a website.
Oruanyi is owned by LAS Logistics and Services. Oruanyi is the brand for our Forward Deployed Engineering work, including process discovery, governed AI implementation, websites and supporting operating assets. Engagements are scoped with a human owner. This website does not represent an independent certification body or promise a particular business result.
ChatGPT seats give people access to an AI tool. An Oruanyi Forward Deployed Engineering engagement scopes work around a business process: its systems, people, permissions and approval boundaries. Discovery maps the opportunity; an Engine engagement builds the agreed system in the client environment. Buying seats alone does not provide that implementation, integration or ongoing governance work.
PHP2Shell is Oruanyi’s short name for CVE-2026-109618 and CVE-2026-109619, two critical vulnerabilities in PHP itself, disclosed on 21 October 2026, with fixed releases dated 22 October 2026. An internet attacker could take over an affected site without logging in. PHP rates both 9.2 on CVSS v4.0. Updating WordPress or plugins does not fix it; PHP itself must be updated.
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 contain the fixes, as do hosting-provider builds that include them. After updating, the server’s PHP processes must restart. Check the full version, such as 8.3.36, not just the branch. PHP 8.2 security support ends on 31 December 2026, so 8.3 or newer is the safer target.
PHP 8.1 and older are end-of-life and receive no official PHP release for these flaws. According to CERT-EU, the PHP security team also published minimal source backports for 7.4, 8.0 and 8.1 for those who build PHP from source; some hosts ship patched builds. Best fix: upgrade to a supported version after testing themes and plugins on staging.
It is, if its server runs a PHP version older than the fixed releases. In WordPress, open Tools, Site Health, Info, Server to see the exact version. On shared or managed hosting the provider installs PHP, so ask them to confirm their build includes both CVE fixes and when it was deployed.
No. Oruanyi’s own website and client desks run on Cloudflare Pages and Workers, not PHP, so PHP2Shell does not affect them. Our PHP work is for client websites, mostly WordPress: we check the PHP version, apply or coordinate the update with the host, confirm the fix and review recent logs for warning signs.
The PHP Scan and vulnerability report is a one-time, non-refundable engagement; its price is in the public pricing table on the pricing page, this FAQ and oruanyi.com/scan. The website owner or the management person in charge of authorization must be the point of contact to engage. The free passive scan at oruanyi.com/scan is separate and reads public pages only.
An engineer checks your exact PHP version against PHP2Shell, looks for other deprecated software such as end-of-life PHP, WordPress core, themes and plugins, and reviews common security gaps like exposed backup files, missing security headers, TLS settings and unexpected admin accounts. You receive a written report with recommended fixes. No exploit testing is performed.
PHP Scan and Fix is optional and follows a scan that finds PHP2Shell or another critical PHP issue. Its flat fee is in the public pricing table; oruanyi.com/scan also describes a base fee plus market-rate option. The written quote states which applies before work starts. It is a one-time security engagement, not a subscription.
Only the site’s owner, or senior management authorized to make decisions for it, can approve an Oruanyi security scan or fix. We ask for that confirmation in writing before any work, and we contact your hosting provider only with your permission. Staff or agencies without that authority need to involve the owner first.
Usually one business day after you reply with hosting access or your host’s name. If your host controls PHP, we open a ticket on your behalf and keep you informed while it is pending, which can take longer. We confirm the new version after the restart, skim recent logs and send a written close-out.
Enter a public website you own, confirm you have permission, and give a work email. After you confirm from that email, Oruanyi reads public pages only: the homepage, robots.txt, sitemap, llms.txt, security headers, accessibility and performance. It never logs in or submits forms. You receive a private report link with planning estimates.
Forward Deployed Engineering means engineers work inside your business process and deliver a working system, not just a recommendation. At Oruanyi, Discovery maps the process and its risks, Engine builds the agreed system in your environment, and Governance maintains it. Buying software seats gives access to a tool, but no implementation, integration or governance.
Discovery is a $2,000 kickoff plus a $500 per month keep-alive retainer; it maps the process, ranks opportunities and produces an architecture blueprint. Engine costs $24,500–$48,000, typically over six to eight weeks, and builds the agreed system in your environment. You can buy Discovery alone; Engine is a separate written decision.
HIPAA-aligned means a website or workflow is designed with privacy, security, access, logging and human-oversight safeguards in mind. It does not mean Oruanyi certifies your organization, becomes your covered entity or guarantees compliance. Your obligations depend on your role and legal advice. Never send protected health information through Oruanyi’s public forms.
The pricing page, this FAQ and oruanyi.com/llms.txt show the same public table: Discovery, Engine, Governance, redesign of an existing site, the free passive scan, PHP Scan and vulnerability report, and PHP Scan and Fix. The PHP lines are one-time security engagements, not pricing tiers. These are planning figures; a person reviews the final scope, agreement and invoice.
No. Do not submit protected health information, passwords, payment card details or secrets through the public request form or O-Center discovery questions. The HIPAA or security-sensitive answer is routing metadata only. It tells us that a separate scoping conversation is needed before any sensitive workflow, access arrangement or required agreement can be considered.
Open the private O-Center link from your receipt and choose Delete this request while it is still in draft, submitted or acknowledged. You confirm with the work email you originally submitted. Deletion removes the request details and revokes its access tokens. A confirmation email is attempted after deletion. If email delivery is unavailable, the page reports that separately; a delivery failure does not restore the deleted request.
No. A friendly ticket number is a label for your request, not authorization to view it. The private link also contains a random access token. O-Center removes that token from the address bar and keeps it in memory while the page is open. The database stores a hash of the token. Keep the original receipt link private.
No. The public request form works without an account and returns a private receipt link. You can open the ticket O-Center with that link, which acts as your access token. Accounts exist for the newer desks: sign in at app.oruanyi.com with your username or email and password. A request submitted anonymously keeps its own receipt and token, separate from any account you later create.
Sign in at app.oruanyi.com using the username or email and password you registered. The desk you land on depends on your role: a client account opens the client desk at /o-center to bind websites and review its tickets; a staff superadmin account opens the operations desk at /ops. A client account cannot reach /ops, and a superadmin has no client memberships. Signing in does not attach a ticket to your account unless it was created under that account.
Yes. In your account you can request closure with a required confirmation checkbox, and optionally request erasure of personal records where law allows, in the style of EU GDPR Article 17. Oruanyi emails a private confirmation link that expires within 24 hours; nothing changes before you confirm it. If you ask for erasure, invoices, scan authorization and fraud or security logs may still be retained for a documented legal period, and your workspace becomes unavailable.
No. A request can only be deleted while it is still in draft, submitted or acknowledged. Once work is completed, the request is locked and no longer shows a delete option; the private link keeps working for viewing, but deletion is denied to keep the finished record intact. If you believe a completed request is wrong, contact the operations team instead of attempting deletion.
Discovery is a $2,000 kickoff; the $500 per month line is a Discovery keep-alive retainer, not Engine. Engine remains $24,500–$48,000 for the agreed build in the client environment. Governance is a later retainer, guided at $3,500–$8,500 per month. Catalog modules, including redesign of an existing site at $8,000–$24,000, are add-ons outside the $2,000. These figures support planning; the final scope, agreement and invoice require human review.
Oruanyi invoices engagements, with ACH Direct Debit as the default. Under the approved payment policy, invoices over $5,000 require ACH unless Oruanyi grants a written exception. Any credit-card surcharge requires advance disclosure and is limited by the applicable rules and actual acceptance cost. Debit and prepaid cards are never surcharged. This release does not collect payments online.
No. US WhatsApp marketing blasts are outside this release and Oruanyi’s planned workflow. Any later WhatsApp integration will use the official WhatsApp Cloud API, with consent and an approved communication purpose. Unofficial WhatsApp Web automation and personal-account QR linking are excluded. Submitting a request does not subscribe you to WhatsApp marketing or authorize automated outreach.
O-Center can record stationery file details as craft-pending so an engineer can discuss the work with you. The file contents are not uploaded or automatically enhanced in this release. The future toolbox range of $299–$899 per month is informational copy only. There is no subscription purchase path, automatic charge or instant logo-generation promise here.
All public prices
Last updated . Planning figures; a person reviews the final scope, agreement and invoice.
| Offer | Price | Notes |
|---|---|---|
| Discovery — Process Mapping | $2,000 kickoff + $500/month keep-alive | The keep-alive retainer keeps Discovery alive; it is not Engine. |
| Engine — Build & Deploy | $24,500–$48,000 one-time | Builds the agreed system in your environment, typically in six to eight weeks. |
| Governance — Maintain & Evolve | $3,500–$8,500/month | Usually after Engine hypercare or a written review of an existing system. |
| Redesign of an existing site | $8,000–$24,000 | Catalog module; not inside the $2,000 Discovery kickoff. |
| Passive website scan (/scan) | Free | Public pages only, after you confirm by email. |
| PHP Scan and vulnerability report | $499, non-refundable | Written vulnerability report for a PHP or WordPress site. A one-time security engagement, not Discovery or Engine. |
| PHP Scan and Fix | $2,499 | Fixes PHP2Shell or another critical PHP issue the scan finds; the written quote confirms terms before work. |
See the full engagement and payment terms, or request an engagement.
