Ubuntu 20.04 end of life: what to do now
Standard support for Ubuntu 20.04 "Focal Fossa" ended on 31 May 2025. Here is what still works, what Ubuntu Pro buys you, and the safest way to get to 24.04 or 26.04.
- Standard support
- Ended 31 May 2025, 524 days ago
- With Ubuntu Pro
- Security fixes to May 2030
- Move to
- 24.04 (to May 2029) or 26.04 (to May 2031)
- Path
- 20.04 → 22.04 → 24.04 in place, or a rebuild on 26.04
What end of life means for 20.04
Nothing switches off. A 20.04 server boots, serves sites and runs cron jobs exactly as it did. The change is in what arrives from apt: without Ubuntu Pro, no more security fixes for the packages in Main (the kernel, OpenSSH, OpenSSL, Apache, Nginx, PHP, MySQL) or in Universe.
That matters more each month. Flaws found after May 2025 stay open, and scanners, pen testers and customers' security questionnaires all flag an unsupported release. "Is any of your software past vendor support?" is now a standard question, and on 20.04 without Pro the answer is yes.
Third-party repositories go the same way. The popular PHP PPA and many vendors' own apt repositories have dropped or are dropping 20.04 builds, so even software you installed from outside Ubuntu stops getting updates.
Your three options
| Option | What it costs | What you get | When it fits |
|---|---|---|---|
| Ubuntu Pro on 20.04 | $500 a year per physical server (all its VMs); free for up to five machines; hourly through AWS, Azure or Google Cloud | Security fixes for Main and Universe to May 2030, plus Livepatch for kernel fixes without a reboot | Buying time while the upgrade is planned, or a server that is retiring anyway |
| Upgrade in place | A planned window, twice: 20.04 → 22.04, then 22.04 → 24.04 | The same server, same IP and same data, on a release supported to May 2029 | A well-kept server with few third-party repositories and a good snapshot |
| Rebuild on 26.04 | A new server running alongside the old one for a few days | A clean 26.04 install, supported to May 2031, built from a written recipe, with the old one kept as the way back | A server that has drifted for years, or one nobody fully understands any more |
Prices are Canonical's list prices, read from ubuntu.com on 6 November 2026. Pro also comes with an optional Legacy add-on that extends coverage further, at 50% more.
Don't stop at 22.04
The in-place route goes through 22.04, and it is tempting to stop there. Standard support for 22.04 ends in May 2027, so a server upgraded to 22.04 today needs the same job again within months.
Plan for 24.04 or 26.04 from the start. In place, 24.04 is two upgrades in one project, with the sites tested after each, and 26.04 would be a third. A rebuild goes straight to 26.04 in one move, which is often less work overall for a server with years of changes on it, and buys two more years.
What changes on the way up
These are the changes that break things. Most of them are in the 20.04 to 22.04 step; a rebuild on 26.04 meets all of them at once.
| Package | 20.04 | 22.04 | 24.04 | 26.04 | What to watch |
|---|---|---|---|---|---|
| PHP | 7.4 | 8.1 | 8.3 | 8.5 | Old WordPress plugins and pre-Laravel 9 code fail on PHP 8. Test every site, or keep the version you need from a supported PHP repository. |
| OpenSSL | 1.1.1 | 3.0 | 3.0 | 3.x | TLS 1.0 and 1.1 and SHA-1 certificates are refused by default. Old payment gateways, APIs and database servers can stop connecting. |
| OpenSSH | 8.2 | 8.9 | 9.6 | 10.2 | ssh-rsa (SHA-1) signatures are off from 22.04, so old deploy tools and SFTP clients can fail to log in. 24.04 starts SSH from a systemd socket, so check a custom port. 26.04 drops DSA keys entirely. |
| Python | 3.8 | 3.10 | 3.12 | 3.14 | Virtualenvs must be rebuilt. On 24.04, pip install outside a virtualenv is blocked. |
| PostgreSQL | 12 | 14 | 16 | 18 | The old cluster keeps running on the old version after the upgrade. Move it with pg_upgradecluster, after a backup. |
| MySQL | 8.0 | 8.0 | 8.0 | 8.4 | 8.0 until 24.04, and 8.0 itself reached end of life in April 2026. On 26.04, accounts still using mysql_native_password are locked out by default, so move them to caching_sha2_password first. |
| Firewall | iptables | nftables | nftables | nftables | iptables commands still work through the nftables back end, but scripts that save and restore rules by hand need checking. |
Before you upgrade
Find every 20.04 server. Run lsb_release -ds or cat /etc/os-release on each one, and pro status to see whether Pro is already attached.
List what came from outside Ubuntu. grep -r ^deb /etc/apt/sources.list.d/ shows the extra repositories. do-release-upgrade switches them off, and each needs re-adding for the new release, or replacing.
Check held packages and space. apt-mark showhold lists anything pinned, which can block the upgrade. Leave a few GB free on / and room in /boot for the new kernel.
Take a snapshot you can restore, and a database dump taken separately. A snapshot is the way back if the upgrade fails half way.
Rehearse on a copy. Restore the snapshot to a spare server, upgrade that, and test every site and job on it. Most of the surprises in the table above turn up here, where they cost nothing.
Then the real window: sudo do-release-upgrade, a reboot, the sites checked, then the same again for 22.04 to 24.04. On a rebuild, the switch is a DNS or IP change once the new server has passed its tests.
If you need time first
Attach Ubuntu Pro today and plan the upgrade properly. Sign in at ubuntu.com/pro to get a token, then run sudo pro attach <token> on the server. ESM for Main and Universe switches on by default, and pro status confirms it. The next apt upgrade brings in the fixes released since May 2025, so do it in a maintenance window.
Pro is the stopgap, not the plan. It fixes security flaws, but PHP 7.4 and the rest of the 20.04 stack still age, and the vendors' own repositories still drop it.
How I run the move
- 01Inventory and a fixed quote
What's on the server, what depends on it, and which of the changes above will bite. In place or rebuild, with the reasons.
- 02Rehearsal on staging
A copy upgraded or rebuilt first, every site and job tested, every problem fixed there.
- 03The window, with a way back
The real move at a time you agree, the old server or a snapshot kept ready, then two weeks' stabilisation.
Upgrades and migrations →
Questions
When did Ubuntu 20.04 reach end of life?
Standard support ended on 31 May 2025. Since then Canonical only ships security fixes for 20.04 to machines with Ubuntu Pro (Expanded Security Maintenance), which runs to May 2030.
Is Ubuntu 20.04 still safe to run?
Not without Ubuntu Pro. A 20.04 server without it gets no new security fixes, so every new flaw in OpenSSH, OpenSSL, the kernel or the web stack stays open. With Pro attached it keeps getting fixes for the core packages until 2030.
Can I upgrade straight from 20.04 to 24.04 or 26.04?
Not in place. do-release-upgrade goes one LTS at a time: 20.04 to 22.04, then 22.04 to 24.04, then 24.04 to 26.04. Rebuilding onto a fresh server skips every middle step and can go straight to 26.04.
Is it worth stopping at 22.04?
Rarely. Standard support for 22.04 ends in May 2027, so you would be doing the same job again within months. Go to 24.04 (supported to May 2029) or, on a rebuild, 26.04 (to May 2031).
How much is Ubuntu Pro?
Canonical lists $500 a year per physical server, covering every VM on it, and a free tier for up to five machines. On AWS, Azure and Google Cloud it is billed by the hour through the provider instead.
Will my customers' security questionnaires accept 20.04 with Pro?
Usually, if you can show Pro is attached and the server is patched. "Is any software past vendor support?" is a standard question, and a yes with a dated upgrade plan reads far better than a 20.04 server with no fixes at all.
Still running 20.04?
Tell me what's on the server. I'll tell you whether to upgrade in place or rebuild, and give you a fixed quote for the move to 24.04.