Linux distributions regularly release security patches for the kernel and installed packages; how quickly you apply them should depend on severity, not a fixed calendar alone.
Recommended approach
- Critical security patches (actively exploited or remotely exploitable with no auth required): apply as soon as possible, ideally within 24–48 hours
- Routine security updates: weekly is a reasonable baseline for most production servers
- Feature/non-security updates: can follow a slower, more deliberate testing cycle
Reducing the operational friction
Automated unattended-upgrade tools can apply security patches automatically, though production servers often still warrant a staging test first for anything that might restart critical services. At minimum, automate the notification of available security updates even if applying them stays manual.
FAQ
Is it safe to fully automate all server updates?
Security-only automatic updates are widely considered safe for most setups; automating all updates (including major version bumps) carries more risk of breaking something and is less commonly recommended without testing.