Turn On Automatic Security Updates on Your VPS

The most common way a self-hosted server gets compromised is not a clever attack. It is an unpatched vulnerability in software that had a fix available for months. So the highest-leverage security automation you can set up is unattended security updates: let the box install security patches on its own, every day, without you remembering to. I turn this on for every VPS in my portfolio before I deploy anything, because a patch that ships but never installs protects nobody. The reason people skip it is fear of an update breaking something, and that fear is manageable.

Why unpatched software is the real risk

When a vulnerability in a common package becomes public, the exploit code shows up fast, and automated scanners start hitting every server on the internet looking for the unpatched version. Your box does not get targeted because someone hates you. It gets caught in a dragnet that sweeps millions of IPs. If the patch is applied, the scan finds nothing. If it is not, you are one of the ones that falls.

The window between a fix being available and an exploit being widespread can be days. No human patches fast enough by hand across a fleet. If you are running one box, maybe you keep up. If you are running twenty, like I am, manual patching guarantees that some box is always behind. Automation is the only way the whole fleet stays current.

Set up unattended security updates

On Debian and Ubuntu, the tool is unattended-upgrades, and it is built for exactly this. The important part is scoping it to security updates only, not every update.

• Install and enable unattended-upgrades.
• Configure it to apply the security repository automatically, and leave general package upgrades for you to do deliberately.
• Set it to email you or log clearly when it acts, so you have a record.
• Enable automatic reboots for kernel updates during a low-traffic window, or handle reboots on your own schedule.

The security-only scope is the key decision. Security patches are almost always safe because they are minimal, backported fixes designed not to change behavior. Feature updates are where surprises live, and you want those to happen when you are watching, not at 3am unattended.

The fear of breakage, handled

The reason people leave patching manual is a story about an update that broke production. It happens, but the way you handle it is not to stop patching, it is to make patching safe to recover from.

First, scope to security updates, as above. That alone removes most of the risk, because security backports rarely break anything.

Second, have backups you can actually restore. If a patch does break something, a working restore turns a disaster into an inconvenience. This is one more reason I keep restore drills sharp: knowing I can roll back removes the fear that would otherwise keep me from patching. The safety net is what lets you automate boldly.

Third, if a box is truly critical and you cannot risk an unattended change, stage it. Apply security updates to a canary box first, confirm nothing breaks, then let the rest of the fleet follow. For most self-hosted apps this is overkill, but the option exists.

Patching is one layer, not the whole wall

Automatic updates keep your software current, but they are not a complete security posture on their own. They pair with the other layers I run on every box: SSH hardened to keys only, a UFW firewall that opens only what you serve, and a brute-force ban. Patching closes the door that a known exploit walks through. The firewall and SSH config close the doors that do not depend on a specific bug. You need all of them, because they defend against different things.

The beauty of automatic patching is that once it is on, it costs you nothing ongoing. The box quietly keeps itself current while you build. Compare that to the alternative, where staying patched is a recurring chore that competes with actual work and therefore slips. Automation wins because it removes the human failure point, and the human failure point is what gets servers owned.

I run unattended security updates on every VPS in my portfolio, hosted through HostSSH. It is the cheapest security decision available: a few minutes of setup, then the machine keeps itself patched forever. Turn it on, scope it to security, keep your backups restorable, and stop losing sleep over the vulnerability you did not hear about.