Updating packages on your Linux VPS

Keeping server packages up to date is the single most important security practice on a self-managed VPS. Package updates patch security vulnerabilities in the OS, web server, PHP, MySQL, and all other installed software. Unpatched servers are regularly compromised through known vulnerabilities.

Why updates matter

Security vulnerabilities are discovered and publicly disclosed regularly. Once a vulnerability is public, attackers scan the internet for unpatched servers. A server that hasn't been updated in months is a high-value target. The fix is simple: update regularly.

Update on Ubuntu / Debian

Ubuntu and Debian use apt for package management:

# Refresh package index
apt update

# Install available updates
apt upgrade -y

# Also upgrade packages that require dependency changes
apt dist-upgrade -y

# Remove unused packages
apt autoremove -y

Run these commands together for a complete update:

apt update && apt upgrade -y && apt autoremove -y

Update on AlmaLinux / CentOS / Rocky Linux

RHEL-based distributions use dnf (or yum on older systems):

# Update all packages
dnf update -y

# Security patches only (if you want to be selective)
dnf update --security -y

Automatic security updates

Configure automatic security-only updates so critical patches are applied without manual intervention:

Ubuntu-unattended-upgrades:

apt install unattended-upgrades -y
dpkg-reconfigure -plow unattended-upgrades

Select "Yes" when prompted. This configures automatic security updates only-it won't automatically upgrade PHP or MySQL major versions.

AlmaLinux-dnf-automatic:

dnf install dnf-automatic -y
# Edit /etc/dnf/automatic.conf and set:
# apply_updates = yes
# upgrade_type = security
systemctl enable --now dnf-automatic.timer

When a reboot is required

Kernel updates require a reboot to take effect. The old kernel continues running until you reboot.

Check if a reboot is needed on Ubuntu:

ls /var/run/reboot-required

If the file exists, a reboot is needed. Plan the reboot for a low-traffic period. See How to safely reboot your VPS.

Related: How to manage your Cloud VPS | How to connect to your VPS via SSH | Setting up a firewall on your VPS | VPS resource monitoring and usage tracking

Related articles