updates

Overview

Keeping software updated is one of the single most important security practices on any system. Package managers make it straightforward, but understanding the difference between updating the index, upgrading packages, and applying security patches matters. This lesson covers updates.

Learning objectives

• Distinguish refreshing the index from upgrading packages.
• Explain why timely updates are critical to security.
• Perform system updates correctly.

Core concept

Updating involves two distinct steps on Debian-based systems:

• Refresh the index — apt update downloads the latest list of available package versions from the repositories. It does not change any installed software.
• Upgrade packages — apt upgrade actually installs newer versions of the packages you have.

On Red Hat systems, dnf upgrade (or dnf update) both refreshes and upgrades. Updates frequently include security patches that fix known vulnerabilities.

How it works

The index refresh tells the system what newer versions exist; the upgrade then downloads and installs them, replacing the old versions. Because a large share of real-world compromises exploit known, already-patched vulnerabilities, applying updates promptly closes those holes before attackers can use them. Many systems also support unattended/automatic security updates so critical patches are applied without manual intervention.

Practical example

$ sudo apt update            # refresh the list of available versions
$ sudo apt upgrade           # install newer versions of installed packages

The first command alone changes nothing installed — a common point of confusion. Only the second actually upgrades software. On Fedora/RHEL, sudo dnf upgrade performs the refresh-and-upgrade in one step.

Cybersecurity relevance

Timely patching is a cornerstone of defense. Attackers routinely scan for systems running outdated, vulnerable versions, so unpatched software is one of the most common entry points — and one of the most preventable. Enumerating whether a system is missing updates is a standard assessment finding, and prompt patching (or automatic security updates) directly reduces risk. The trade-off is testing critical systems before upgrading to avoid breaking changes, balanced against the danger of leaving vulnerabilities open.

Common mistakes

• Thinking apt update upgrades software — it only refreshes the index; apt upgrade does the installing.
• Delaying security updates, leaving known vulnerabilities exploitable.
• Never rebooting when required, so kernel/critical patches do not take effect.

Key takeaways

• apt update refreshes the list of available versions (changes nothing installed); apt upgrade installs the newer versions (on RHEL, dnf upgrade does both).
• Updates deliver security patches for known vulnerabilities, which attackers actively target.
• Prompt patching (or automatic security updates) is among the most effective and preventable defenses; unpatched software is a top attack vector.

Check your understanding

• What is the difference between apt update and apt upgrade?
• Why is prompt patching one of the most effective security measures, given how attackers find targets?