Most compromised Linux servers are not broken by clever zero-days — they fall to known vulnerabilities that had patches available for weeks. Keeping Ubuntu Server updated is the highest-value security work you can do, and Ubuntu makes it easy to automate the critical part. Here is how apt updating really works, and how to put security patches on autopilot.
The two-step dance: update, then upgrade
sudo apt update # refresh the package catalogue sudo apt upgrade -y # install available upgrades
apt update downloads the latest package lists — it changes nothing on the system. apt upgrade actually installs newer versions. Run them together regularly:
See what would change before committing with apt list --upgradable. The occasional “deferred due to phasing” message is normal — Ubuntu rolls some updates out gradually, and your server will receive them within days.
full-upgrade and autoremove
sudo apt full-upgrade -y # also handles changed dependencies (kernels etc.) sudo apt autoremove --purge -y # remove packages nothing needs anymore
full-upgrade (formerly dist-upgrade) may add or remove packages to complete an upgrade — needed for kernel updates. autoremove clears out old kernels and orphaned libraries; combine with the cleanup steps in our disk space guide.
When is a reboot required?
[ -f /var/run/reboot-required ] && cat /var/run/reboot-required
Kernel and libc updates only take effect after a reboot. Check which services run outdated libraries with sudo needrestart (installed by default on 24.04).
Enable automatic security updates
The unattended-upgrades package installs security patches daily without your involvement — every production server should have it:
sudo apt install unattended-upgrades -y sudo dpkg-reconfigure --priority=low unattended-upgrades
Fine-tune in /etc/apt/apt.conf.d/50unattended-upgrades — the two settings worth considering on top of the defaults:
// Email a report when something is upgraded Unattended-Upgrade::Mail "[email protected]"; // Reboot automatically (at 4 am) when a patch requires it Unattended-Upgrade::Automatic-Reboot "true"; Unattended-Upgrade::Automatic-Reboot-Time "04:00";
By default only the security pocket is auto-installed — feature updates still wait for you, which is the safe balance for servers.
Verify it is actually working
sudo unattended-upgrade --dry-run --debug | tail -5 grep "Installing" /var/log/unattended-upgrades/unattended-upgrades.log | tail
Frequently asked questions
Can automatic updates break my server?
Security-pocket updates are conservative and regression-tested; breakage is rare. The bigger operational risk by far is running unpatched. For business-critical servers, LFA IT's managed plans include staged patching with monitoring — updates are applied, verified, and rolled back if anything misbehaves.
Does this upgrade Ubuntu itself to a new release?
No — moving from 22.04 to 24.04 is a release upgrade, a separate, deliberate process: see our safe release upgrade walkthrough.
Related Ubuntu guides
- How to Upgrade Ubuntu 22.04 LTS to 24.04 LTS Safely (Step by Step)
- Initial Ubuntu 24.04 Server Setup Guide: Secure Your New VPS in 10 Steps
- How to Check and Free Up Disk Space on Ubuntu Server
- How to Manage Services on Ubuntu with systemctl: The Complete systemd Guide
Prefer to have experts handle it?
LFA IT provides fully managed Ubuntu VPS and dedicated servers — initial setup, security hardening, monitoring and 24/7 support, so you can focus on your business. Explore our hosting and server management services or open a support ticket and our engineers will take it from there.
