Patching guides for Linux and Unix servers

Updated November 2026

These guides show you how to get security fixes onto Linux and Unix servers quickly and safely, and how to confirm the fix is really in place. Each one gives the exact commands for the main package managers: APT, DNF, Zypper, APK and FreeBSD pkg.

Where to start

If a critical vulnerability was just announced and you need to act now, start with the emergency patching playbook. It walks you through the first hours: deciding how urgent the issue is for you, finding the affected hosts, patching, restarting and checking your work.

If you only need to answer “are we affected?”, go to checking installed versions against an advisory. It explains why a distribution package can be fixed through a backport even when its version number looks older than the upstream release that fixed the bug. That is the most common source of false alarms from scanners and audits.

How the guides fit together

Patching a server has four parts, and most incidents go wrong at one of them:

1. Know what you run. Which operating system release, which packages and which versions. See Check installed versions and whether your OS release still gets fixes.
2. Install the fix. Manually in an emergency, and automatically the rest of the time. See Automatic updates.
3. Load the fix. A patched library on disk does nothing until the programs using it restart. Kernel fixes need a reboot or a live patch. See Restarts and reboots, Kernel updates and Kernel live patching.
4. Check for damage. If the hole was open while attackers were using it, look for signs of compromise. See Signs of compromise.

Per-system pages

The guides here cover tasks that apply to every system. For release-specific details, such as support dates, where the vendor publishes advisories and how its update tools behave, see the Linux distribution pages and the Unix and BSD pages. Current high-profile issues are listed under Vulnerabilities.

All patching guides

• Emergency patchingThe first hours after a critical CVE: triage with KEV and EPSS, find affected hosts, patch, restart, verify, mitigate when no fix exists, and check for compromise.
• Check installed versionsHow to check whether a server is vulnerable to a CVE with dpkg, apt, debsecan, rpm, dnf, zypper, apk and pkg audit, and why backported fixes keep version numbers old.
• Restarts and rebootsInstalling a fix does not patch running programs. Find services still using old libraries with needrestart, needs-restarting or zypper ps, and know when to reboot.
• Kernel live patchingWhat kernel live patching fixes and what it leaves out, how to check it is working on Ubuntu, RHEL, SUSE and Oracle Linux, and why you still need regular reboots.
• Kernel updatesCheck which kernel is running versus installed, keep a known-good kernel, pick the GRUB default, reboot remote servers safely and roll back if a new kernel fails.
• Automatic updatesHow to switch on automatic security updates with unattended-upgrades, dnf-automatic, dnf5 automatic, zypper, apk and freebsd-update, and how to roll them out safely.
• Is my OS supported?End-of-life dates for Debian, Ubuntu, RHEL, Alma, Rocky, SLES, FreeBSD, OpenBSD, AIX, Solaris, macOS, PHP, Node.js and Python, checked on vendor pages, November 2026.
• Patch many serversPatch a fleet safely with Ansible: an inventory, one-line fixes for a single package, a rolling playbook that reboots only when needed, and fleet tools compared.
• Updating PHPSupported PHP branches as of November 2026, how to find the PHP that really serves your site, and exact update and restart steps for apt, Sury, Remi, Alpine and Docker.
• Updating Node.jsWhich Node.js LTS lines are supported in November 2026, how to check what you run, and how to update via apt, NodeSource, nvm or Docker, audit npm packages and restart.
• nginx, Apache, OpenSSLCheck nginx, Apache httpd and OpenSSL versions, patch from distro or upstream repos, test config, reload vs restart, and OpenSSL branches supported as of Nov 2026.
• ContainersPatch Docker and Kubernetes workloads: rebuild from a fresh base image, pin and refresh digests, scan with Trivy, Grype or Docker Scout, roll out, patch the host.
• KubernetesPatch Kubernetes: supported versions 1.35–1.37, kubeadm upgrade plan/apply, drain and kured for node reboots, PDBs, add-ons like ingress and CNI, managed clusters.
• Server hardeningShrink a Linux server's attack surface: find listening services with ss, keep admin panels private, least privilege, file permissions, logs, offline backups and MFA.
• SSH hardeningSwitch SSH to ed25519 keys, turn off password and root logins with a drop-in file, test with sshd -t and a second session, then add AllowGroups, fail2ban and MFA.
• Firewall basicsSet up a default-deny server firewall with ufw, nftables or firewalld, allow SSH first, cover IPv6, stop Docker bypassing it and keep databases off the internet.
• Signs of compromiseA 10-minute check for a Linux server you suspect is hacked: odd processes, new root users, SSH keys, cron jobs, outbound connections, changed binaries, web shells, logs.
• Incident responseWhat to do when a Linux server is hacked: isolate it, preserve evidence, rotate every secret, rebuild from a clean source, restore data, report it and learn from it.
• Security advisoriesAdvisory pages, mailing lists and RSS or CSAF feeds for Debian, Ubuntu, RHEL, SUSE, Alpine, Arch, FreeBSD and OpenBSD, and how to rank fixes with CVSS, KEV and EPSS.
• MikroTik RouterOSUpdate MikroTik RouterOS and RouterBOOT from the CLI, choose a release channel, schedule nightly updates, lock down WinBox, SSH and WebFig, and check for compromise.
• Vulnerability scanningCommands to find missing security fixes: debsecan, apt, dnf updateinfo, zypper, arch-audit, pkg audit, osv-scanner, Trivy, Grype and OpenSCAP, and how to read the output.
• Monitoring planThe order for setting up monitoring on your own Linux server: logs, login alerts, web attack checks, process and network watching, file integrity and intrusion detection.
• Update schedulesExact timer, cron and config snippets to run security updates at a set time on Debian, Ubuntu, RHEL, Fedora, SUSE, Alpine, Arch, the BSDs, macOS and MikroTik.
• Logging and monitoringWhere Linux logs live (journald, /var/log, Debian without rsyslog), how long they are kept, how to send them to another server, and what to check every day.
• Intrusion detectionWhat auditd, AIDE, CrowdSec, fail2ban, OSSEC and Wazuh each detect, ready-to-use audit rules for passwd, sudoers, SSH keys and web shells, and how to choose.
• File integrity monitoringSet up AIDE on Debian, Ubuntu and RHEL (init, daily check, update after patching), verify packages with debsums and rpm -Va, and keep the baseline off the server.
• Login alertsSmall scripts that email or post to a webhook when someone logs in over SSH, uses sudo, adds a user or changes authorized_keys, with rate limiting.
• Web attack monitoringWhat scans and exploit attempts look like in nginx and Apache access logs, grep and awk one-liners, GoAccess, fail2ban jails, ModSecurity/Coraza with CRS and rate limits.
• Process and network watchBaseline listening ports, check outbound connections with ss, spot miners and backdoors, allow-list egress with nftables, log program runs, and alert on port changes.
• HTTPS and TLSSet up TLS 1.2 and 1.3 on nginx or Apache from the TLSRef (ex-Mozilla) profile, roll out HSTS safely, drop OCSP stapling, automate renewals and test with testssl.sh.
• SPF, DKIM, DMARCStop spoofing of your domain and stay off blocklists: SPF and DKIM records, OpenDKIM or rspamd with Postfix, a safe DMARC rollout to p=reject, MTA-STS and TLS-RPT.
• GlossaryPlain definitions of 58 security and patching terms for server admins: CVE, CNA, CVSS v3.1 and v4.0, KEV, EPSS, CWE, backports, LTS, ESM, EOL, VEX, web shells and C2.
• Security checklistA one-page server security checklist: daily, weekly and monthly tasks, steps after every critical CVE, and checks before a new server goes live, each linked to a guide.