Catalog / CMS, e-commerce & learning

Drupal

Content management system for structured, multilingual websites

CIS Level 1 hardened Ubuntu 24.04 LTS image by Lynxroute · unique credentials at first boot · CVE-scanned · SBOM and CIS report inside

AWS Marketplace11.4.11↗ Azure Marketplace11.4.11↗
Availability and pricing
CloudVersionSoftware priceLast build
AWS Marketplace
EC2 AMI · all commercial regions
11.4.11$0.05/hr
Recommended instance: t3.medium · 5-day free trial
2026-10-23Listing ↗
Azure Marketplace
VM image · plan payg-gen2 · Gen2
11.4.11$0.028/vCPU/hr
Recommended VM: Standard_D2s_v3
2026-10-24Listing ↗

Software price only; cloud infrastructure is billed separately by the provider. Prices in USD.

Image facts
Base OSUbuntu 24.04 LTS
HardeningCIS Level 1, Ubuntu 24.04 LTS (tailored)
LicenseGPL-2.0-or-later
UpstreamDrupal community / Drupal Association
Machine-readableproduct.json · catalog.json
What is Drupal

Drupal is a leading open-source content management system (CMS) and web application framework used by governments, universities, and enterprises worldwide. It is a PHP application backed by a MySQL/MariaDB or PostgreSQL database and served by nginx with PHP-FPM; this image installs it with Composer (the drupal/recommended-project layout). Drupal gives you structured content types and fields, taxonomy, the Views query builder, flexible URL aliases, a roles-and-permissions access model, revisions and workflows, multilingual content, a theming layer, a REST/JSON:API for headless and decoupled front-ends, and one of the largest module ecosystems of any CMS. Because you self-host it, all content and visitor data stays inside your own AWS account, which makes GDPR and data-residency compliance straightforward. Drupal is GPL-2.0-or-later licensed with no vendor lock-in.

What the Lynxroute image adds

Security hardening:

  • Site pre-installed at first boot with a unique admin password (no install wizard, no shipped default credential)
  • Unique MariaDB password generated at first boot; the database and PHP-FPM bound to 127.0.0.1 only - never exposed to the network
  • TLS enabled on port 443 with a self-signed certificate (replace with your own CA/Let's Encrypt certificate for production)
  • The Update Status beacon is disabled - the image does not phone home to drupal.org for version checks (you can re-enable it under Extend)
  • settings.php locked down and the public files directory isolated; trusted host patterns tracked automatically
  • UFW firewall pre-configured (ports 22, 80, 443 only)
  • fail2ban, auditd, and AppArmor pre-configured
  • CVE scan - every image is scanned for vulnerabilities before release

OS hardening (CIS Level 1):

  • CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown
  • auditd, SSH key-only access, kernel hardening, IMDSv2 enforced

Compliance artifacts:

  • SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
  • CIS Conformance Report at /etc/lynxroute/cis-report.html
  • CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md

Drupal is a registered trademark of Dries Buytaert. This product is built on the open-source Drupal software and is not affiliated with, endorsed by, or sponsored by the Drupal project or the Drupal Association.

Deploy

Launch in one command

Credentials are generated at first boot and written to /root/drupal-credentials.txt.

# subscribe once on the AWS Marketplace listing, then:
aws ec2 run-instances \
  --image-id resolve:ssm:/aws/service/marketplace/prod-7pfile4wlhluk/latest \
  --instance-type t3.medium --key-name my-key --security-group-ids sg-xxxxxxxx
# accept the plan terms once, then:
az vm image terms accept --publisher lynxroute --offer drupal --plan payg-gen2
az vm create -g my-rg -n drupal --size Standard_D2s_v3 \
  --image lynxroute:drupal:payg-gen2:latest --admin-username azureuser --generate-ssh-keys
Release notes

Latest release

The most recent release with notes; the full release history is in product.json.

Drupal 11.4.11

AWS · 2026-10-23Azure · 2026-10-24
  • Drupal core updated 11.4.8 -> 11.4.11. GPL-2.0-or-later unchanged
  • Security (Critical): SA-CORE-2026-014, remote code execution in Field UI (CVE-2026-108097)
  • Security: SA-CORE-2026-015 (Link field XSS, CVE-2026-108515) and SA-CORE-2026-016 (Navigation XSS, CVE-2026-108514)
  • Security: ships the PHP2Shell fix (CVE-2026-109618, CVE-2026-109619; unauthenticated remote code execution in PHP) via Ubuntu php8.3 8.3.6-0ubuntu0.24.04.13 (USN-8948-1). Earlier images of this product carry the vulnerable PHP and should be replaced
  • Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base, picking up every operating-system security update published since the previous build