Keeping server software patched: web, database, mail and more

Updated November 2026

Most break-ins do not start with the operating system but with the software on top of it: the web server, PHP, a database left open to the internet, an old control panel or plugin. Each page shows how to check your version, which versions are still supported, and how to update safely.

Where to start

1. Make a list of what runs on your server. sudo ss -tulpn shows every program that listens on the network; those are the ones attackers can reach first.
2. Check each one against its supported versions. Each page below has a table. A version that no longer receives fixes is the biggest risk, whatever else you do.
3. Prefer your distribution's packages. They receive security fixes through the normal system update, often as backported fixes with the same version number. Use the project's own repository only when you need a newer version, and then keep that repository updated too.
4. Restart after updating. A library or service update is not active until the program restarts. See what to restart.
5. Keep databases, panels and admin tools off the internet. Most mass attacks find them with simple scans.

Also see Updating PHP, Updating Node.js, Patching nginx, Apache and OpenSSL and the live list of vulnerabilities that need patching now.

All software guides

• nginxFind which nginx you run and where it came from, the fixed upstream versions (stable 1.30.6, mainline 1.31.8), update commands per OS, config test and restart.
• Apache httpdCheck your Apache httpd version and loaded modules, what 2.4.69 fixed in October 2026, update commands for each OS, then test the config and restart safely.
• OpenSSLOpenSSL 3.5 LTS, 4.0 and 4.1 support dates as of November 2026, how to see which OpenSSL each program uses, update commands per OS, and what to restart afterwards.
• OpenSSHPatch OpenSSH fast: check the installed and running version, distribution backports, update commands per OS, restarting sshd safely, advisories and hardening tips.
• Core system packagesWhy sudo, glibc, systemd, polkit and kernel updates need a restart or reboot, how to check the versions you run, update commands per OS, and notable recent advisories.
• curl and gitPatch curl, libcurl and git fast: check versions, distribution packages vs upstream, update commands per OS, which services to restart, advisories and safe-use tips.
• PythonWhich Python branches get security fixes in November 2026, how to update system Python and app virtual environments safely, and how to scan packages with pip-audit.
• Java (OpenJDK)Supported Java LTS versions (8, 11, 17, 21, 25) by vendor in November 2026, the quarterly patch dates, and how to update distro, Temurin and container JDKs safely.
• Apache TomcatSupported Tomcat branches (11.0, 10.1, 9.0) in November 2026, the October security fixes, and how to update packages, tarballs and Docker images, then verify.
• Docker EnginePatch the Docker host: supported Docker Engine, containerd and runc versions, update commands per distro, live restore, and why port 2375 must never be open.
• BIND DNSKeep BIND 9 patched: 9.20 is the only supported stable branch as of November 2026. Version checks, update commands per OS, safe restarts, ISC advisories.
• SambaPatch Samba file servers and AD domain controllers: supported 4.25, 4.24 and 4.23 series, version checks, update commands per OS, safe restarts and advisories.
• MySQL and MariaDBCheck your MySQL or MariaDB version, which LTS series are still supported as of November 2026, update commands per OS, restart and verify, and keep port 3306 private.
• PostgreSQLCheck your PostgreSQL version, supported majors and EOL dates (14 ends November 12, 2026), apply minor updates per OS, plan major upgrades and keep 5432 private.
• Redis and ValkeyCheck your Redis or Valkey version, supported series as of November 2026, update commands per OS, safe restarts, and locking down port 6379 with bind and ACLs.
• MongoDB and ElasticsearchSupported MongoDB and Elasticsearch versions as of November 2026, update and rolling-restart steps, and how to keep ports 27017 and 9200 away from ransom bots.
• Exim and PostfixCheck your Exim or Postfix version, see which releases upstream still supports (Nov 2026), update on Debian, RHEL, SUSE, Alpine and FreeBSD, and restart safely.
• Dovecot and RoundcubeCheck Dovecot and Roundcube versions, see supported releases as of Nov 2026 (Dovecot 2.4, Roundcube 1.7 and 1.6 LTS), apply updates on each distro and restart safely.
• HAProxy and VarnishHAProxy LTS branches and Varnish/Vinyl Cache releases supported as of Nov 2026, how to check your version, update on each distro, test the config and reload or restart.
• cPanel and WHMCheck your cPanel and WHM build, pick a release tier, set /etc/cpupdate.conf, run upcp, keep OS packages updated, and lock WHM port 2087 to admin IPs with 2FA.
• PleskKeep Plesk Obsidian patched: check the version, supported 18.0 updates, plesk installer commands, auto-update and system update settings, port 8443 limits and MFA.
• Webmin and VirtualminUpdate Webmin, Virtualmin and Usermin from their package repositories, check versions, review 2026 security fixes, keep port 10000 off the internet and turn on 2FA.
• DirectAdmin and HestiaCPUpdate DirectAdmin and HestiaCP: check versions, update channels, da update and CustomBuild, Hestia auto-updates, OS support dates, ports 2222 and 8083, and 2FA.
• WordPressCheck your WordPress, plugin and theme versions, update them with WP-CLI, turn on auto-updates, verify checksums, set file permissions and delete unused plugins.
• Joomla and DrupalSupported Joomla and Drupal versions as of November 2026, Drupal 10 end of life on December 9, how to update core and extensions with the CLI, Composer and Drush.
• MagentoSupported Magento Open Source and Adobe Commerce versions, the monthly isolated security patches, the CVE-2026-75650 hotfix, and Composer update steps.