System hardening
Apply security updates
Track Ubuntu support, install security fixes promptly, plan reboots, and test application health after changes.
8 minute lesson
Known vulnerabilities become easier to exploit after public disclosure. Keep the operating system inside a supported update path.
Refresh package metadata, review pending updates, apply security fixes, and check whether a reboot is required. Automate updates only with monitoring and a recovery plan. Snapshotting is useful, but it does not replace a tested application rollback and backup.
A kernel fix may install successfully but remain inactive until reboot. Automatic updates shorten exposure, while staged updates make application regressions easier to catch.
Record the running kernel and package version separately. That evidence prevents a successful package command from being mistaken for a completed fix when the vulnerable code remains loaded.
Record pending packages, installed versions, reboot state, and service checks before and after updating. Break one health check or use a disposable failed service, then prove monitoring detects the incomplete maintenance.
Lesson completed