I created an Ubuntu server on Digital Ocean to deploy my app on. Less then 24 hours later, I log in to the server and see this:
18 packages can be updated.
7 updates are security updates.
I install the updates, only to find a very similar situation the next day.
Even if I update every day, seems like the server will have multiple un-patched security issues at any given time!
Seems like a server accessible from the Internet is all but guaranteed to be hacked in short order, isn't it?
The problem is less likely the security of the Ubuntu system as shipped by the distributor. It is very rare that there are critical issues which allow an remote attacker to hack the system. And while there are sometimes critical issues which allow privilege escalation by a local user they are rare too. But you can actually limit the impact further by only installing the software you really need - anything which isn't there cannot be exploited.
What you see as security updates are almost always less critical problems, like exposing address layout which might be used to bypass ASLR, security updates for software you don't even use but have installed, updates for issues which happen only in specific environments or with non-standard configuration, updates for issues which allow applications to crash (denial of service) but cannot be used to take over the system etc. See usn.ubuntu.com for the details. Anything which might help an attacker to advance is considered a security issue but in most cases the attacker needs to be local already or can only do uncritical harm.
But in no way you should feel secure just because you've applied all security updates coming with the system or feel totally insecure just because you've missed the once from the last days. It is more likely that a hack will be done be exploiting issues in your own web application you've deployed on the server or that you've used weak password to protect parts of your system. It is actually the most common way that system gets owned through thus user-generated weaknesses and not through weaknesses caused by the underlying OS.
Thus, while you should keep your system up-to-date you should not blindly rely on these updates keeping your system secure. Additionally you should make sure that your own applications and configurations are secure too. This aspect might even be more relevant in securing the system than keeping the system always up-to-date.
Can it be hacked in days? Sure.
Most known vulnerabilities will never be exploited, but those that are tend to be exploited quickly. Often bad guys are doing recon within a day of an easy to exploit vulnerability going public and have an exploit within two or three days. How do you know what vulnerabilities will be exploited? You don't. That's why patching is so important. And don't ignore patching mediums and lows. While they aren't as important to patch quickly, they can be an important part of a successful breach.
It depends on how the server is accessible, and whether it's an actual target anyone is trying to actively hack(as opposed to various bots that that try to log in as root with password of "password" that exclusively hit ports 22 and 2222).
Firstly, a key concept here is attack surface. If you only have SSH and Apache with a static website running, and all other ports are blocked by firewall, then there just isn't much that can be exploited even if there are vulnerabilities that haven't been patched yet. If you have PHP, SQL and Wordpress running, then suddenly there are a lot more attacks that can be successfully executed if any of them are vulnerable. And as the attack surface grows - as you have more programs running and more services that can be accessed(directly or indirectly) - the probability of there being an exploit that can be used to target your server grows.
Secondly, you have to consider the threat model: Who is trying to hack into your server and why? Apart from the aforementioned bots(which, as noted, are generally foiled just by following reasonably good password practices and not using default usernames like root, admin, etc.), who would try to get into your server? Hacking people takes time, and most people who do it just for fun prefer doing it legally. If you have a personal website that gets a couple dozen visitors per day, there isn't much to be gained from hacking it(if, on the other hand, you're running the website for a large corporation, you need to seriously consider the threat of someone spending a lot of effort to gain access to your system).
Thirdly, updates are typically not as time critical as you seem to think. Yes, there are zero-day exploits in the wild and sometimes a vulnerability can be exploited very quickly, but even if a vulnerability is known it takes time to develop an exploit - and in many cases, the exploits will only be known by the developers and a few security researchers until a patch has been developed and is ready to be deployed. So even if you don't patch instantly, it's unlikely that anyone could exploit the particular vulnerability within a few days(unless it's one for which a zero-day exploit is known).
In conclusion, while it's almost certainly possible for your server to get hacked within a few days, as long as you follow reasonable security practices(and aren't being specifically targeted by malicious actors) it's very unlikely to happen just because it took you a day or two to apply the latest security patches.
