
What you actually get
The headline is Linux 7.0, but on a server the interesting changes are lower down the stack.
PostgreSQL 18 is the upgrade worth planning around: its new I/O subsystem brings substantial gains on read-heavy workloads. PHP 8.5 matters if you host applications; check your framework’s compatibility before you move.
Post-quantum cryptography also lands as a default rather than an experiment. OpenSSL ships ML-KEM, ML-DSA and SLH-DSA, and OpenSSH 10.2 supports post-quantum key exchange.
Read this before migrating
This release removes things. Four changes can break a working server, and none of them announce themselves loudly.sudo-rs is the default sudo provider. A memory-safe reimplementation, and a deliberate reduction in attack surface — but it does not cover every option of the original. Exotic sudoers rules deserve a test before you rely on them in production.
apt-key is removed. APT 3.1 also switches from GnuTLS to OpenSSL. Any provisioning script still calling apt-key add will fail. Keys belong in /etc/apt/keyrings/ with a signed-by= reference in the source entry.
DSA is removed from OpenSSH. The algorithm has been deprecated for years, but if an old key or an embedded device still relies on it, the connection simply stops working.
Two more worth noting: chrony replaces systemd-timesyncd as the default time daemon, and 26.04 is the last release to keep the systemd compatibility layer for System V init scripts. If you still ship one, this is your notice.

