How to Install Only Security Updates with yum and dnf

Updated: 18 October 2026 · Applies to: AlmaLinux 10.2 and 9.8, Rocky Linux 10.2 (dnf 4.20 and 4.14, tested), RHEL 9 according to Red Hat; Debian 13 and Ubuntu 24.04 (unattended-upgrades, tested)

To install only security updates on AlmaLinux, Rocky Linux or RHEL, run sudo yum update --security, or the same with dnf: sudo dnf upgrade --security. To see first which security fixes are waiting, run sudo yum updateinfo list --security. On version 8 and later the yum command is dnf (on AlmaLinux 10.2, /usr/bin/yum is a link to dnf-3), so the security options are built in and the old yum-plugin-security package is not needed.

CentOS Linux 5, 6, 7 and 8 are end of life (CentOS Linux 8 on 31 December 2021, CentOS Linux 7 on 30 June 2024) and get no security updates any more. The CentOS 7 repositories also did not carry the security metadata these commands read (the CentOS 7.9 updates repository has no updateinfo file), so yum update --security found nothing there even while CentOS 7 was supported. Move such servers to AlmaLinux or Rocky Linux, which publish security advisories (ALSA and RLSA).

1. See which security updates are waiting

1. Show a summary by severity:

   sudo dnf updateinfo summary

   On an AlmaLinux 10.2 lab container this showed (first line, the metadata check, removed):

   Updates Information Summary: available
       5 Security notice(s)
           4 Important Security notice(s)
           1 Moderate Security notice(s)

2. List each advisory with the package version that fixes it:

   sudo dnf updateinfo list --security

   ALSA-2026:76781 Moderate/Sec.  glibc-2.39-142.el10_2.alma.1.x86_64
   ALSA-2026:76918 Important/Sec. openssl-libs-1:3.5.8-2.el10_2.alma.1.x86_64
   ALSA-2026:77020 Important/Sec. python3-3.12.15-1.el10_2.x86_64
   ALSA-2026:76734 Important/Sec. rpm-sequoia-1.10.2.1-1.el10_2.x86_64
   ALSA-2026:75769 Important/Sec. vim-minimal-2:9.1.083-9.el10_2.22.x86_64

   (lab output, shortened: packages from the same advisory, such as glibc-common, removed). The first column is the advisory ID: ALSA on AlmaLinux, RLSA on Rocky Linux (Rocky Linux 10.2 showed RLSA-2026:55432 Important/Sec. curl-8.12.1-4.el10_2.4.x86_64) and RHSA on RHEL. The second is the severity: Critical, Important, Moderate or Low.
3. Read one advisory, including the CVE numbers it fixes:

   sudo dnf updateinfo info ALSA-2026:76918

     Important: openssl security update
     Update ID: ALSA-2026:76918
          Type: security
          CVEs: CVE-2026-84782
      Severity: Important

   (shortened: the description and bug lines removed).

Useful variations, all tested on AlmaLinux 10.2:

• dnf updateinfo list --sec-severity=Important: only one severity (use Critical for the most urgent).
• dnf updateinfo list --security --with-cve: also lists the CVE numbers each advisory fixes.
• dnf updateinfo list --security --installed: advisories that are already applied, which helps you prove that a fix is in. --all shows both, with an i in front of the installed ones.
• dnf check-update --security: the package names only. It exits with code 100 when updates are waiting and 0 when there are none, which is handy in monitoring scripts.

The old CentOS 6 and 7 spelling still works, because dnf accepts it: yum updateinfo list security printed the same list on AlmaLinux 10.2.

2. Install the security updates

1. All security updates:

   sudo dnf upgrade --security

   The lab container listed 10 packages, including openssl-fips-provider, which is in no advisory itself: dnf adds the packages an update depends on. To preview without installing, add --assumeno.
2. The smallest change that still fixes the problems:

   sudo dnf upgrade-minimal --security

   According to the dnf documentation, this updates each package only to the nearest version that carries the fix, not to the newest one. On the lab container both commands picked the same versions, because the newest version was also the fix.
3. One advisory, or one CVE:

   sudo dnf upgrade --advisory=ALSA-2026:75769
   sudo dnf upgrade --cve CVE-2026-84782

   The advisory updated vim-data and vim-minimal and ended with Complete!; the CVE pulled in openssl-libs and openssl-fips-provider.

Check the ID carefully. A mistyped advisory or CVE number gives no error. dnf just prints:

No security updates needed, but 10 updates available
Dependencies resolved.
Nothing to do.
Complete!

You see the same message when all security fixes are in and only bug fix updates are left. Plain yum update or dnf upgrade without --security installs everything, which is what most servers should do on a regular schedule anyway.

3. Check whether a reboot is needed

Some updates, such as a new kernel or glibc, take full effect only after a reboot. The needs-restarting command (package dnf-plugins-core, missing from minimal images) tells you:

sudo dnf install dnf-plugins-core
sudo dnf needs-restarting -r

After the glibc update in the lab it printed (last line, a Red Hat link, removed):

Core libraries or services have been updated since boot-up:
  * glibc

Reboot is required to fully utilize these updates.

It exits with code 1 when a reboot is needed and 0 (Reboot should not be necessary.) when not; needs-restarting -s lists services to restart instead. See how to check the running and installed kernel and how to reboot Linux from the command line.

4. Install security updates automatically

1. Install the tool:

   sudo dnf install dnf-automatic

2. In /etc/dnf/automatic.conf, change upgrade_type = default to:

   upgrade_type = security

3. Enable the timer that installs updates (Red Hat's instructions for RHEL 9):

   sudo systemctl enable --now dnf-automatic-install.timer

On AlmaLinux 10.2 the timer runs daily at 6:00 with a random delay of up to 60 minutes. The config file's reboot = never keeps the server from restarting by itself; when-needed reboots only when an update needs it. Test the result on a non-critical server first.

5. Debian and Ubuntu

apt has no --security switch. Security fixes come from a separate security repository, which apt list shows after the package name, so filter on it:

sudo apt update
apt list --upgradable | grep -- -security

Lab examples: Debian 13 showed liblzma5/stable-security 5.8.1-1+deb13u2 amd64 [upgradable from: 5.8.1-1+deb13u1] and Ubuntu 24.04 showed libssl3t64/noble-updates,noble-security 3.0.13-0ubuntu3.16 amd64 [upgradable from: 3.0.13-0ubuntu3.15]. sudo apt upgrade installs them together with the other pending updates. Automatic security updates are handled by unattended-upgrades:

• Ubuntu Server has it installed and running by default, limited to security updates, according to Ubuntu's server documentation. On Ubuntu 24.04 the allowed sources in /etc/apt/apt.conf.d/50unattended-upgrades are the release itself, noble-security and the two ESM security pockets, not noble-updates.
• Debian 13: install it with sudo apt install unattended-upgrades. In our test, installing it also enabled it (/etc/apt/apt.conf.d/20auto-upgrades had both settings at "1"). Note that Debian's default list in 50unattended-upgrades includes the normal Debian archive as well as Debian-Security, so it also installs stable point-release updates, not only security fixes.
• Preview what it would do with sudo unattended-upgrade --dry-run -v; logs are in /var/log/unattended-upgrades/.

If you would rather not handle patching yourself, our Managed cPanel VPS includes updates, security and monitoring by our team.

Official documentation: Red Hat: managing and monitoring security updates, dnf command reference and Debian wiki: UnattendedUpgrades.