| Package | Version | |
|---|---|---|
| libssl3 | 3.0.2-0ubuntu1.12 → 3.0.2-0ubuntu1.15 | security |
| openssl | 3.0.2-0ubuntu1.12 → 3.0.2-0ubuntu1.15 | security |
| curl | 7.81.0-1ubuntu1.14 → 7.81.0-1ubuntu1.16 | security |
sudo apt update && sudo apt upgrade. A reboot is required after a kernel update.This page lists the security updates waiting to be applied, separated from ordinary package updates, together with whether unattended upgrades are configured and when they last ran.
The field that matters more than any list of packages is the reboot-required flag. Kernel and core library updates install successfully and do nothing until the machine restarts, so a server can be fully patched by every report and still running the vulnerable code in memory. Uptime is not an achievement on a server that has been holding an unapplied kernel patch for two hundred days.
Unattended upgrades are worth enabling on almost every server, with two adjustments: keep it to the security archive rather than all updates, and set a maintenance window so restarts happen when you choose. The failure mode people fear — an automatic update breaking a service unattended — is far rarer than the alternative, which is a known vulnerability sitting unpatched for months because nobody had time.
The updates are installed by unattended-upgrades, and the work does not end there. Packages change files on disk, so the next run of AIDE and debsums will report differences — legitimate ones, but worth reading through to tell your own changes from someone else's. Restarted services deserve a separate look: Monit will notice the one that did not come back. And having automatic updates enabled is something Lynis counts towards the hardening index — one of the few items that raises the score and genuinely lowers the risk.