Linux

Keep a Linux VPS patched

Unattended upgrades, reboot when the kernel needs it, and do not skip the guest.

The hypervisor is patched on our side. The guest OS is yours. An unpatched Linux VPS is the usual way a box gets mined.

Debian and Ubuntu

Install unattended upgrades and enable the security pocket. Reboot when /var/run/reboot-required appears, or schedule a weekly window.

Bash

apt update
apt install -y unattended-upgrades
dpkg-reconfigure -plow unattended-upgrades

Enable dnf-automatic. Apply kernel updates and reboot; live patching is optional, not a substitute for a plan.

Bash

dnf install -y dnf-automatic
systemctl enable --now dnf-automatic.timer

Do not hold packages forever "because the site works." Do not run two panels and then wonder why apt fights you.

Patch before you expose WordPress or a panel to the internet. The first hour is when scanners show up.