Is Debian 12 still getting security updates?

Yes. Regular security support from the Debian Security Team ended in June 2026. The Debian LTS team now provides security fixes for the main architectures until June 2028.

Does LTS cover every package?

No. Debian LTS covers most of the archive but some packages are excluded or only partly supported. Run the debian-security-support package to see what is not covered on your server.

Should I upgrade Bookworm to Trixie in place?

In-place upgrades are well tested on Debian. Snapshot first, read the Trixie release notes, change the sources to trixie, then run apt full-upgrade.

Debian 12 Bookworm VPS in London

Where Bookworm stands

Debian 12 shipped in June 2023. Debian 13 replaced it as stable in August 2025, and Bookworm's regular security support ended in June 2026. Since then, fixes come from the Debian LTS project, which plans to support it until June 2028. Point releases have stopped. Security updates continue through the same bookworm-security suite, so nothing in your sources list needs to change.

That gives a Bookworm server deployed today roughly a year and a half of patches. Use it to clone an existing Debian 12 fleet for testing, or to run software certified only on Bookworm. Start greenfield work on Debian 13.

What you get

The image is deliberately sparse. Linux 6.1 LTS kernel, systemd 252, OpenSSL 3.0, Python 3.11, PostgreSQL 15 in the archive, and very little running at boot. There's no snap, no firewall front-end and no mail agent listening. A freshly booted Bookworm VM is about as quiet as Linux gets, which makes it easy to audit.

First boot

apt update && apt full-upgrade -y
apt install -y sudo unattended-upgrades apt-listchanges needrestart
dpkg-reconfigure -plow unattended-upgrades
adduser admin && usermod -aG sudo admin

Debian does not configure automatic updates by default on a minimal install. The dpkg-reconfigure step enables the daily security-only run. Check the origin pattern in /etc/apt/apt.conf.d/50unattended-upgrades includes Debian-Security.

Firewall: use nftables directly

Debian 12 uses nftables as its packet filter backend, and iptables commands are translated onto it. You can install ufw, but writing a short nftables ruleset is clearer and survives reboots with one service:

cat >/etc/nftables.conf <<'EOF'
#!/usr/sbin/nft -f
flush ruleset
table inet filter {
  chain input {
    type filter hook input priority 0; policy drop;
    ct state established,related accept
    iif lo accept
    ip protocol icmp accept
    tcp dport { 22, 80, 443 } accept
  }
}
EOF
nft -c -f /etc/nftables.conf && systemctl enable --now nftables

The -c flag checks syntax without applying. Get it right before you load a policy-drop ruleset over SSH. If you get it wrong anyway, open the browser console in the portal and run nft flush ruleset.

Checking LTS coverage

apt install -y debian-security-support
check-support-status

This lists installed packages that the LTS team has marked as unsupported or limited. Browsers, some large web applications and a few language ecosystems commonly appear. If something you rely on shows up, that package needs another source or the server needs to move to Trixie.

Moving to Debian 13

Debian's in-place upgrades are routine. Take a portal snapshot first. That snapshot is your rollback plan.

sed -i 's/bookworm/trixie/g' /etc/apt/sources.list /etc/apt/sources.list.d/*.list
apt update
apt upgrade --without-new-pkgs -y
apt full-upgrade -y
reboot

Run it inside tmux so a dropped connection doesn't kill the upgrade halfway. Trixie also moves sources towards the deb822 .sources format. apt modernize-sources converts them after the upgrade.

Bookworm gotchas

No sudo by default on minimal installs. Install it before you disable root SSH.
Python externally managed. As on Ubuntu, pip install into the system interpreter is refused. Use a venv.
Interface names. Network configuration lives in /etc/network/interfaces or systemd-networkd depending on the image build. Check which one is active before you edit anything.
Backports for newer software. Need a newer package without leaving Bookworm? bookworm-backports exists, but backports get less LTS attention. Prefer upgrading the OS.

A sensible use for Bookworm now

The best reason to deploy Debian 12 in late 2026 is rehearsal. Clone the shape of a production Bookworm server, restore last night's backup onto it, then run the Trixie upgrade on the copy. You find the broken config files and the package conflicts on a throwaway box, take notes, and run the real upgrade with a tested checklist.

Sizing

Bookworm's small footprint makes Spark a genuine option for DNS resolvers, small proxies and monitoring agents. PostgreSQL 15 with a modest dataset is happy on Boost. Larger databases need RAM for shared buffers and page cache, so look at Nitro with 12 GB.