{
 "slug": "percona-mysql",
 "name": "Percona Server for MySQL",
 "tagline": "Drop-in MySQL-compatible database with XtraBackup hot backups",
 "category": "database",
 "use_cases": [
  "relational-database",
  "mysql-compatible",
  "hot-backup"
 ],
 "aliases": [
  "percona server",
  "percona server for mysql"
 ],
 "status": "live",
 "upstream": {
  "vendor": "Percona",
  "url": "https://www.percona.com/mysql/software/percona-server",
  "license": "GPL-2.0",
  "license_url": "https://github.com/percona/percona-server/blob/8.4/LICENSE"
 },
 "image": {
  "os": "Ubuntu 24.04 LTS",
  "cis_level": 1,
  "ports": [
   3306,
   80,
   443
  ],
  "artifacts": [
   "/etc/lynxroute/sbom.json",
   "/etc/lynxroute/cis-report.html",
   "/usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md"
  ]
 },
 "clouds": {
  "aws": {
   "status": "live",
   "version": "8.4.11",
   "last_build": "2026-10-23",
   "entity_id": "prod-jjwrsc5yayj3o",
   "ami_alias": "/aws/service/marketplace/prod-jjwrsc5yayj3o/latest",
   "listing_url": "https://aws.amazon.com/marketplace/pp/prodview-xi4sxqtewzlai",
   "recommended_instance_type": "t3.medium",
   "price_usd_per_hour": 0.05,
   "free_trial_days": 5,
   "unit": "instance-hour"
  },
  "azure": {
   "status": "live",
   "version": "8.4.11",
   "last_build": "2026-10-26",
   "offer_id": "percona-mysql",
   "plan_id": "payg-gen2",
   "image_urn": "lynxroute:percona-mysql:payg-gen2:latest",
   "listing_url": "https://azuremarketplace.microsoft.com/en-us/marketplace/apps/lynxroute.percona-mysql?tab=Overview",
   "recommended_vm_size": "Standard_D2s_v3",
   "price_usd_per_vcpu_hour": 0.028,
   "unit": "vcpu-hour"
  },
  "alicloud": {
   "status": "not_offered"
  }
 },
 "urls": {
  "page": "https://lynxroute.com/products/percona-mysql/",
  "json": "https://lynxroute.com/products/percona-mysql/product.json"
 },
 "release_notes": [
  {
   "version": "8.4.11",
   "title": "Percona Server 8.4.11 + phpMyAdmin 5.2.3 r2",
   "notes": "* Security: fixes PHP2Shell (CVE-2026-109618, CVE-2026-109619), an unauthenticated remote code execution flaw in PHP, by shipping Ubuntu php8.3 8.3.6-0ubuntu0.24.04.13 (USN-8948-1). Every earlier image of this product carries the vulnerable PHP; replace running instances or run: sudo apt-get update && sudo apt-get install --only-upgrade \"php8.3*\"\n* The application version is unchanged (Percona Server 8.4.11, phpMyAdmin 5.2.3); this is a security rebuild\n* phpMyAdmin is served by PHP 8.3 FPM behind the nginx TLS perimeter on 443 (/phpmyadmin/)\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base, picking up every operating-system security update published since the previous build\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-10-23",
    "azure": "2026-10-26"
   }
  },
  {
   "version": "8.4.10",
   "title": "Percona Server 8.4.11 + phpMyAdmin 5.2.3 - Percona Server upgraded to 8.4.11 (from 8.4.10), adding OpenID Connect (OIDC) authentication against external identity providers with IDP-group-to-MySQL-role mapping and runtime JWKS key refresh, and improving InnoDB LRU flushing, NUMA buffer-pool initialisation and highly concurrent range-select throughput. Includes the MySQL 8.4.11 Community Edition fixes. phpMyAdmin web administration UI (PHP 8.3 FPM) behind the nginx TLS perimeter on 443 (/phpmyadmin/); cookie auth against Percona Server, per-instance blowfish_secret generated at first boot, setup script removed.",
   "notes": "",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-07-23",
    "azure": "2026-07-27"
   }
  },
  {
   "version": "8.4.8",
   "title": "Percona Server 8.4.8 + phpMyAdmin 5.2.3 - June 2026",
   "notes": "* Added the phpMyAdmin web administration UI (v5.2.3, PHP 8.3 FPM) from the official phpMyAdmin release tarball (SHA256-verified)\n* phpMyAdmin served only over HTTPS behind an nginx TLS perimeter on 443 (/phpmyadmin/); authenticates against Percona Server (cookie auth)\n* Per-instance cookie blowfish_secret generated at first boot; the setup/ script is removed (hardening)\n* No new database port opened - the UI is reached on 443, governed by your Security Group\n* Percona Server 8.4.8 itself unchanged from the previous release\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-06-18",
    "azure": "2026-06-25"
   }
  },
  {
   "version": "8.4.8",
   "title": "Percona Server for MySQL 8.4.8 - Initial release (June 2026)",
   "notes": "* Percona Server for MySQL 8.4.8 LTS on Ubuntu 24.04 LTS (official Percona packages)\n* CIS Level 1 hardening applied (ansible-lockdown/UBUNTU24-CIS)\n* CVE-scanned before every release\n* A root password and a sample application database/user generated at first boot - never a default or empty password\n* Anonymous users and the test database removed; root restricted to localhost\n* Native TLS enabled at first boot with a per-instance self-signed certificate (--ssl-mode=REQUIRED)\n* Percona XtraBackup 8.4 and Percona Toolkit bundled for hot backups and operations\n* X protocol (33060) bound to localhost; port 3306 governed by your Security Group\n* UFW firewall pre-configured (SSH on 22; 3306 governed by your Security Group)\n* fail2ban, auditd, AppArmor pre-configured\n* SBOM (CycloneDX 1.6) at /etc/lynxroute/sbom.json\n* CIS Conformance Report (OpenSCAP) at /etc/lynxroute/cis-report.html\n* IMDSv2 enforced\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-06-18",
    "azure": "2026-06-25"
   }
  }
 ],
 "release_history": [
  {
   "version": "8.4.11",
   "aws": "2026-10-23",
   "azure": "2026-10-26"
  },
  {
   "version": "8.4.10",
   "aws": "2026-07-23",
   "azure": "2026-07-27"
  },
  {
   "version": "8.4.8",
   "aws": "2026-06-18",
   "azure": "2026-06-25"
  }
 ],
 "deploy": {
  "aws_cli": "# subscribe once on the AWS Marketplace listing, then:\naws ec2 run-instances \\\n  --image-id resolve:ssm:/aws/service/marketplace/prod-jjwrsc5yayj3o/latest \\\n  --instance-type t3.medium --key-name my-key --security-group-ids sg-xxxxxxxx",
  "azure_cli": "# accept the plan terms once, then:\naz vm image terms accept --publisher lynxroute --offer percona-mysql --plan payg-gen2\naz vm create -g my-rg -n percona-mysql --size Standard_D2s_v3 \\\n  --image lynxroute:percona-mysql:payg-gen2:latest --admin-username azureuser --generate-ssh-keys"
 },
 "description": {
  "what_is": "Percona Server for MySQL is a free, open-source, drop-in replacement for MySQL Community Edition, implemented in C/C++ as a multi-threaded relational database server with the InnoDB storage engine. It keeps full wire-protocol and behaviour compatibility with upstream MySQL, so existing applications, drivers, and tools connect unchanged, while adding enhanced instrumentation and performance diagnostics. It offers ACID transactions, the SQL standard, native JSON, generated columns, window functions, common table expressions, full-text and spatial indexes, stored procedures, replication, and the caching_sha2_password authentication plugin. The image bundles Percona XtraBackup for hot, non-blocking physical backups and Percona Toolkit for database operations. Data is persisted on disk with InnoDB redo logging and doublewrite. Running it yourself in your own VPC keeps your data inside your AWS account rather than a managed service. GPL-2.0 license, no vendor lock-in.",
  "image_adds": "Security hardening:\n* A root password and a sample application database plus user are generated at first boot - never a default or empty password\n* Anonymous users and the test database are removed (secure-installation equivalent); root is restricted to localhost\n* Native TLS enabled at first boot with a per-instance self-signed certificate - no shared private key is baked into the image; clients connect with --ssl-mode=REQUIRED\n* Listens for VPC-internal access only - port 3306 is governed by your Security Group, not exposed to the internet; the X protocol (33060) is bound to localhost\n* UFW firewall - SSH on 22; port 3306 governed by your Security Group\n* fail2ban, AppArmor\n* CVE scan - every image is scanned for vulnerabilities before release\n\nWeb administration (phpMyAdmin):\n* phpMyAdmin web UI - browse tables, run SQL, import/export, and manage users from your browser\n* Served only over HTTPS behind an nginx TLS perimeter on 443 (per-instance self-signed certificate; swap in your own with certbot)\n* Authenticates against Percona Server (cookie auth) - no separate account store; the setup script is removed and the cookie blowfish secret is generated per-instance at first boot\n* No new database port is opened - the UI is reached on 443, governed by your Security Group\n\nOS hardening (CIS Level 1):\n* CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown\n* auditd, SSH hardening, Kernel hardening, IMDSv2 enforced\n\nCompliance artifacts:\n* SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json\n* CIS Conformance Report at /etc/lynxroute/cis-report.html\n* CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md"
 },
 "generated_at": "2026-10-31T09:36:34Z"
}