Ubuntu publishes Ubuntu Security Notices (USNs) with a mailing list, an Atom feed and an RSS feed. Debian publishes Debian Security Advisories (DSAs) to the debian-security-announce mailing list and an RSS feed. Subscribe a shared team inbox or a feed reader, not one person's mailbox.
What each source gives you
| Source | ID format | Delivery | Extra data |
|---|---|---|---|
| Ubuntu | USN, for example USN-8911-1 | Mailing list, Atom, RSS | OVAL files per release, searchable by CVE or release |
| Debian | DSA, for example DSA-6570-1 | debian-security-announce list, RSS | Security Tracker with a status page per CVE |
Ubuntu says a USN is issued when a security issue is fixed in an official Ubuntu package. Debian says it coordinates many advisories with other free software vendors, so they are often published the same day a vulnerability becomes public.
The suffix after the number is a revision. USN-8887-3 is the third notice in a series, which usually means the same issue was fixed in another package variant or for another release. Read it as a new notice for a new set of systems, not a duplicate.
Setting it up
- Create a shared mailbox or channel such as security-advisories, owned by a team.
- Subscribe it to the mailing lists, or point a feed reader or chat integration at the RSS or Atom links on each vendor's security page.
- Filter by the releases you actually run. Ubuntu's notice page has a release filter, and a Debian advisory names the package and release.
- Decide the action for each notice type in advance: auto-apply, queue for the next window, or escalate.
- Name a reader of the day. A feed that belongs to everyone belongs to no one.
If you use automated tooling, ingest the machine-readable data instead of email. Ubuntu offers OVAL files, an industry-standard format listing known vulnerabilities and fixes for each release, which can be used to audit whether the latest fixes are applied. Debian also publishes OVAL data.
Reading a notice quickly
For each notice, answer:
- Which source package is it? Debian's FAQ notes the advisory names the source package, and you should update all binary packages built from it.
- Which release and version fix it?
- Is the package installed on our hosts? A kernel notice matters everywhere, a notice for one daemon matters only where it runs.
You will see long kernel notices. One recent Ubuntu notice listed three CVE IDs and then more than a thousand others. Do not read those line by line. Update the kernel, schedule the reboot, and confirm the running version afterwards.
Pair it with automatic updates
Ubuntu says that since 16.04 LTS, releases apply most security updates daily by default. Debian's page points to the unattended-upgrades package for the same purpose. If your servers run these, the feed tells you what is coming and why. It is a record, not an alarm for every line.
Where you cannot auto-apply, say for databases with fixed change windows, the advisory feed is your queue.
Try it yourself
Click through it at your own pace, or open it full screen.
Look at how a finding gets an owner and a status, which is the same step your shared inbox needs.
Safeguard does container image and dependency scanning, so base image packages from these distributions show up in the same view as your application libraries. A free scan shows how.
Quick check
Where do I find the Ubuntu feed?
On Ubuntu's security notices page there are links for the mailing list, Atom and RSS.
Do I need to read every Debian advisory?
No. Filter to the packages and releases you run, and let automatic updates handle routine fixes.
Sources
- Ubuntu, Security notices
- Ubuntu, About CVEs
- Debian, Security information
- Debian, Security FAQ
Last reviewed: 19 October 2026.
