The single most important ongoing maintenance task.
WHY
Most server compromises exploit known vulnerabilities in unpatched software. The fix existed; it was not applied.
APPLYING THEM
Use your distribution's package manager to refresh the package list and apply available updates.
On Debian and Ubuntu this is apt. On Rocky and AlmaLinux it is dnf.
HOW OFTEN
Security updates: as soon as practical, and at minimum weekly.
Full system updates: monthly, with a backup taken first.
AUTOMATIC SECURITY UPDATES
Both families offer automatic application of security patches. Enabling this is usually right for a server you do not check daily.
Be aware that some updates require a service restart or a reboot to take effect.
REBOOTS
Kernel updates need a reboot. Tools exist that tell you when one is pending.
Schedule reboots rather than deferring them indefinitely. A server running an old kernel with a known vulnerability is exposed regardless of the patch being installed.
BEFORE MAJOR UPDATES
Take a snapshot or backup. A failed update on a remote server is considerably harder to recover from than on a machine in front of you.
