Availability and pricing

Cloud	Version	Software price	Last build
AWS Marketplace EC2 AMI · all commercial regions	7.2.1	$0.05/hr Recommended instance: t3.large · 5-day free trial	2026-10-23	Listing ↗
Azure Marketplace VM image · plan payg-gen2 · Gen2	7.2.1	$0.028/vCPU/hr Recommended VM: Standard_D2s_v3	2026-10-26	Listing ↗

Software price only; cloud infrastructure is billed separately by the provider. Prices in USD.

Image facts

Base OS	Ubuntu 24.04 LTS
Hardening	CIS Level 1, Ubuntu 24.04 LTS (tailored)
License	GPL-3.0
Upstream	Mautic Community (Open Source Collective)
Machine-readable	product.json · catalog.json

What is Mautic

Mautic is the leading open-source marketing automation platform - a Symfony 7 PHP 8 web application served by Nginx with PHP-FPM and MariaDB. The bundled feature set covers email campaigns and broadcasts, drip workflows and trigger-based automation, lead segmentation and scoring, landing pages and signup forms, multi-channel campaigns (email, SMS, social), A/B testing, contact lifecycle reporting, REST API, and a web hook engine. Connects to any standard SMTP relay (Amazon SES, SendGrid, Mailgun, Postmark, Postfix) for outbound delivery. Persists contacts, segments, campaigns, templates, and tracking data in MariaDB. A drop-in self-hosted alternative to HubSpot, Mailchimp, ActiveCampaign, and Marketo for B2B teams, agencies, and GDPR-sensitive organisations who keep their contact database inside their own AWS account. GPL-3.0 license, governed by the Mautic community under the Open Source Collective - no per-contact fees, no vendor lock-in.

What the Lynxroute image adds

Security hardening:

Per-instance MariaDB password generated and rotated at first launch (never the same on two deployments)
Customer-driven admin via the upstream Mautic installer wizard - no admin account baked into the image
MariaDB bound to 127.0.0.1 only - no exposed database port
PHP-FPM auto-tuned at first launch (workers and OPcache sized from instance RAM)
UFW firewall pre-configured - ports 22, 80, and 443 only
fail2ban, AppArmor
CVE scan - every image is scanned for vulnerabilities before release

OS hardening (CIS Level 1):

CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown
auditd, SSH hardening, Kernel hardening, IMDSv2 enforced

Compliance artifacts:

SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
CIS Conformance Report at /etc/lynxroute/cis-report.html
CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md

Deploy

Launch in one command

Credentials are generated at first boot and written to /root/mautic-credentials.txt.

AWS CLIAzure CLI

# subscribe once on the AWS Marketplace listing, then:
aws ec2 run-instances \
  --image-id resolve:ssm:/aws/service/marketplace/prod-4kpgzxudpcqzq/latest \
  --instance-type t3.large --key-name my-key --security-group-ids sg-xxxxxxxx

# accept the plan terms once, then:
az vm image terms accept --publisher lynxroute --offer mautic --plan payg-gen2
az vm create -g my-rg -n mautic --size Standard_D2s_v3 \
  --image lynxroute:mautic:payg-gen2:latest --admin-username azureuser --generate-ssh-keys

Release notes

Latest release

The most recent release with notes; the full release history is in product.json.

Mautic 7.2.1 r2

AWS · 2026-10-23Azure · 2026-10-26

Security: fixes PHP2Shell (CVE-2026-109618, CVE-2026-109619), an unauthenticated remote code execution flaw in PHP, by shipping Ubuntu php8.3 8.3.6-0ubuntu0.24.04.13 (USN-8948-1). Every earlier image of this product carries the vulnerable PHP; replace running instances or run: sudo apt-get update && sudo apt-get install --only-upgrade "php8.3*"
The application version is unchanged (Mautic 7.2.1); this is a security rebuild
HTTPS on by default: self-signed TLS on port 443; Certbot pre-installed - sudo certbot --nginx -d yourdomain.com
Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base, picking up every operating-system security update published since the previous build