On July 11th, 2026 the Debian project released Debian 13.6, the sixth update to its stable branch, Debian 13 “trixie”. Like every point release, it is not a new version: it is the same trixie with all the security patches and fixes for serious bugs accumulated since 13.5 already rolled in. If you update regularly you will barely notice the jump; if you are coming from an older install, this is the convenient way to catch up in one go.
What 13.6 brings
The bulk of the revision is security updates. The official announcement lists 84 advisories (DSA-6250 through DSA-6384), touching a good number of packages that run on servers and desktops every day. Among the most notable:
- apache2, with 8 CVEs fixed (use-after-free, XSS, buffer overflows and denial-of-service issues).
- curl, with 11 vulnerabilities resolved.
- qemu, with 23 security fixes — important for anyone running virtual machines.
- Plus fixes to samba, the Linux kernel and many other components.
Two changes deserve a separate mention. First, fwupd is updated to enable renewing the CA, db and KEK keys over UEFI, a step aimed at the Secure Boot certificate transition that many machines will need over the coming years. Second, geoip-database has been reverted to its December 2019 version for licensing reasons — a reminder that in Debian legal correctness carries as much weight as the technical kind.
How to upgrade
There is nothing to download by hand and no reinstall required. Just point the package manager at any of Debian’s HTTP mirrors and upgrade like any other day:
sudo apt update
sudo apt full-upgradeAnyone already tracking security.debian.org will have very little to fetch, since critical patches ship there as soon as they land. For fresh installs, the 13.6 images are already available at the usual download locations, saving you dozens of updates after the first boot.
Who should care
Anyone running Debian 13, and especially anyone administering servers exposed to the internet. A minor point release is not glamorous, but 84 security advisories are 84 reasons not to leave it for next week. The advice is the same as always with Debian: update soon, test in a trusted environment if you manage a large fleet, and move on.
You can read the full breakdown in the official Debian 13.6 announcement and check the distribution’s lifecycle and support dates on its Debian page.