Availability and pricing

Cloud	Version	Software price	Last build
AWS Marketplace EC2 AMI · all commercial regions	5.4.10	$0.05/hr Recommended instance: t3.medium · 5-day free trial	2026-10-23	Listing ↗
Azure Marketplace VM image · plan payg-gen2 · Gen2	5.4.10	$0.028/vCPU/hr Recommended VM: Standard_D2s_v3	2026-10-24	Listing ↗

Software price only; cloud infrastructure is billed separately by the provider. Prices in USD.

Image facts

Base OS	Ubuntu 24.04 LTS
Hardening	CIS Level 1, Ubuntu 24.04 LTS (tailored)
License	GPL-2.0-or-later
Upstream	Open Source Matters, Inc.
Machine-readable	product.json · catalog.json

What is Joomla

Joomla is a mature open-source content management system (CMS) for building websites, blogs, corporate portals, and intranets. It is a PHP 8.3 web application served by Nginx with PHP-FPM and backed by a MariaDB database. The bundled feature set covers article and content management with categories and tags, a templating system for site themes, flexible menu management, multilingual sites, fine-grained user management and access control levels (ACL), a media manager, banners, contacts, news feeds, and a powerful extension system of components, modules, and plugins. Thousands of free and commercial extensions and templates are available from the Joomla Extensions Directory. A self-hosted alternative to WordPress and Drupal for structured, multi-author content. GPL-2.0-or-later license - no per-seat fees, no vendor lock-in, all data inside your own AWS account.

What the Lynxroute image adds

Security hardening:

Super User and MariaDB credentials generated at first launch (saved to /root/joomla-credentials.txt)
Web installer runs non-interactively and the installation folder is removed automatically
HTTPS on by default (self-signed) with HTTP redirected to HTTPS; Certbot pre-installed for Let's Encrypt in one command
MariaDB database accessible from localhost only
PHP-FPM bound to loopback behind the Nginx reverse proxy
UFW firewall - ports 22, 80, 443 only
fail2ban, AppArmor
CVE scan - every image is scanned for vulnerabilities before release

OS hardening (CIS Level 1):

CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown
auditd, SSH hardening, Kernel hardening, IMDSv2 enforced

Compliance artifacts:

SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
CIS Conformance Report at /etc/lynxroute/cis-report.html
CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md

Deploy

Launch in one command

Credentials are generated at first boot and written to /root/joomla-credentials.txt.

AWS CLIAzure CLI

# subscribe once on the AWS Marketplace listing, then:
aws ec2 run-instances \
  --image-id resolve:ssm:/aws/service/marketplace/prod-nj7zpbvyojysu/latest \
  --instance-type t3.medium --key-name my-key --security-group-ids sg-xxxxxxxx

# accept the plan terms once, then:
az vm image terms accept --publisher lynxroute --offer joomla --plan payg-gen2
az vm create -g my-rg -n joomla --size Standard_D2s_v3 \
  --image lynxroute:joomla:payg-gen2:latest --admin-username azureuser --generate-ssh-keys

Release notes

Latest release

The most recent release with notes; the full release history is in product.json.

Joomla 5.4.10

AWS · 2026-10-23Azure · 2026-10-24

Joomla updated 5.4.9 -> 5.4.10, a bugfix release. GPL-2.0-or-later unchanged
Web services API PATCH fixes; banners now respect category access and published state
Security: ships the PHP2Shell fix (CVE-2026-109618, CVE-2026-109619; unauthenticated remote code execution in PHP) via Ubuntu php8.3 8.3.6-0ubuntu0.24.04.13 (USN-8948-1). Earlier images of this product carry the vulnerable PHP and should be replaced
Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base, picking up every operating-system security update published since the previous build