Keeping Your System Updated: Patch Vulnerabilities Promptly

Patching is the cheapest, highest-return security control you have. Learn to update by hand, enable automatic security updates, handle kernel reboots, and back up before you start.

The moment a server goes online, it's under constant scanning. Most breaches aren't the work of elite hackers — they're attackers exploiting known vulnerabilities that were patched long ago but never applied. Staying current is the smallest investment with the biggest security payoff.

Why patch promptly

  • Close known holes. Once a vulnerability (CVE) is published, automated scanners and exploit kits sweep the internet within days. Unpatched servers are the first targets.
  • Stability and compatibility. Updates also fix crashes, memory leaks, and compatibility bugs — not just security flaws.
  • Debt compounds. Skip updates for months and changes pile up; the eventual forced upgrade carries far more risk and work.

Updating by hand: know your distro first

The commands differ by distribution — don't mix them up.

Ubuntu / Debian family (apt):

sudo apt update        # refresh the package index
sudo apt upgrade       # upgrade installed packages
sudo apt full-upgrade  # allow adding/removing deps to upgrade (was dist-upgrade)
sudo apt autoremove    # clean out obsolete dependencies

RHEL / CentOS / Rocky / AlmaLinux / Fedora family (dnf):

sudo dnf upgrade                    # upgrade everything (dnf update is an alias)
sudo dnf upgrade --security         # install security updates only
sudo dnf updateinfo list security   # see which security updates are pending

Automatic security updates

Security fixes often can't wait. You can have the system install only security updates automatically while keeping feature upgrades under manual control.

Ubuntu / Debian:

sudo apt install unattended-upgrades
sudo dpkg-reconfigure --priority=low unattended-upgrades

The policy lives in /etc/apt/apt.conf.d/50unattended-upgrades, where you can enable automatic reboots, allowlists, and more.

RHEL family:

sudo dnf install dnf-automatic
# edit /etc/dnf/automatic.conf: set apply_updates = yes, scope to security
sudo systemctl enable --now dnf-automatic.timer

> Rule of thumb: automatic security updates are safe to enable. Leave major-version and kernel upgrades for manual runs during a controlled window.

Kernel updates and reboots

Most updates only need the affected service restarted, but core components — the kernel, glibc, systemd — require a full reboot to take effect.

Ubuntu / Debian: install needrestart and upgrades will flag which services need restarting and whether the kernel changed:

sudo apt install needrestart
sudo needrestart
# if this file exists, a reboot is required
cat /var/run/reboot-required

RHEL family:

sudo dnf install dnf-utils
needs-restarting -r   # exit status tells you if a full reboot is needed
needs-restarting -s   # list services that need restarting

When a reboot is genuinely needed, run sudo reboot during off-peak hours. If you need live kernel patching without downtime, look into kpatch (RHEL) or Ubuntu Livepatch — but still reboot fully on a regular cadence.

Before you update: back up and test

No matter how good your automation is, keep an escape route.

  • Snapshot or back up first. Take a snapshot of your VPS, or back up key config (/etc) and data before upgrading, so you can roll back in seconds.
  • Test before production. Run significant changes on a staging or test box before touching live servers.
  • Know how to revert. Review recent transactions with apt's /var/log/apt/history.log or dnf history, and roll back if needed.
  • Roll out in waves. With a fleet, update a small subset first, watch for problems, then proceed.

Subscribe to security advisories

Knowing early beats getting hit. Subscribe to your distro's security notices (Ubuntu Security Notices, Red Hat / Rocky / Debian security mailing lists) and follow the official channels for the software you run — databases, web servers, language runtimes — so you can react to high-severity issues the moment they land.

Summary

  • Patching isn't optional: unpatched known vulnerabilities are the number-one way in.
  • Memorize both toolsets: apt update && apt upgrade (Debian family) and dnf upgrade (RHEL family) — never mix them.
  • Enable automatic security updates (unattended-upgrades / dnf-automatic) to shrink your exposure window.
  • After kernel-level updates, check with needrestart / needs-restarting -r and reboot on your schedule.
  • Always snapshot or back up first, test significant changes before production, and roll out in waves.
  • Subscribe to security advisories so your response outruns the attackers.