I created an Ubuntu server on Digital Ocean to deploy my app on. Less then 24 hours later, I log in to the server and see this:

18 packages can be updated.
7 updates are security updates.

I install the updates, only to find a very similar situation the next day.

Even if I update every day, seems like the server will have multiple un-patched security issues at any given time!

Seems like a server accessible from the Internet is all but guaranteed to be hacked in short order, isn't it?

  • 1
    I don't think missing a security update for a few days will cause your server to be hacked 99% of time. I would assume vere few of those security updates are for some super critical RCE vulnerability. If leaving your default Ubuntu server unupdated for a few days would cause it to be hacked practically every server out there would be hacked
    – trallgorm
    Commented Feb 15, 2019 at 19:26
  • 1
    Think carefully about what ports you have open and what services are listening on those ports.
    – DarkMatter
    Commented Feb 15, 2019 at 19:31
  • @trallgorm If there was a security update every few months and I installed it a day or two late, intuitively it does not seem very risky, like you say. But seeing the message "7 updates are security updates" after 24 hours, leads me to believe that I can update every day and still have multiple un-patched security vulnerabilities at any given time.
    – George
    Commented Feb 15, 2019 at 19:36
  • @DarkMatter Indeed, this is good advice. The only services I have listening are sshd (port 22) and systemd-resolve (port 53). I assume that all security updates that the system tells me about are for packages that are actually installed on the server and can be hacked in some way. This is why some updates are called security updates and other aren't.
    – George
    Commented Feb 15, 2019 at 19:44
  • @George my point was that while you will have un-patched security vulnerabilities, you will likely not be hacked. For example just picking a random recent CVE: cvedetails.com/cve/CVE-2019-6445. All this allows the attacker to do is IF they already have access to your server, they can crash some application that may or may not actually impact anything on your system. Missing the security update patch for that would likely never affect you even if you had it for years. The vast majority of security issues are like that.
    – trallgorm
    Commented Feb 15, 2019 at 19:57

3 Answers 3


The problem is less likely the security of the Ubuntu system as shipped by the distributor. It is very rare that there are critical issues which allow an remote attacker to hack the system. And while there are sometimes critical issues which allow privilege escalation by a local user they are rare too. But you can actually limit the impact further by only installing the software you really need - anything which isn't there cannot be exploited.

What you see as security updates are almost always less critical problems, like exposing address layout which might be used to bypass ASLR, security updates for software you don't even use but have installed, updates for issues which happen only in specific environments or with non-standard configuration, updates for issues which allow applications to crash (denial of service) but cannot be used to take over the system etc. See usn.ubuntu.com for the details. Anything which might help an attacker to advance is considered a security issue but in most cases the attacker needs to be local already or can only do uncritical harm.

But in no way you should feel secure just because you've applied all security updates coming with the system or feel totally insecure just because you've missed the once from the last days. It is more likely that a hack will be done be exploiting issues in your own web application you've deployed on the server or that you've used weak password to protect parts of your system. It is actually the most common way that system gets owned through thus user-generated weaknesses and not through weaknesses caused by the underlying OS.

Thus, while you should keep your system up-to-date you should not blindly rely on these updates keeping your system secure. Additionally you should make sure that your own applications and configurations are secure too. This aspect might even be more relevant in securing the system than keeping the system always up-to-date.


Can it be hacked in days? Sure.

Most known vulnerabilities will never be exploited, but those that are tend to be exploited quickly. Often bad guys are doing recon within a day of an easy to exploit vulnerability going public and have an exploit within two or three days. How do you know what vulnerabilities will be exploited? You don't. That's why patching is so important. And don't ignore patching mediums and lows. While they aren't as important to patch quickly, they can be an important part of a successful breach.


It depends on how the server is accessible, and whether it's an actual target anyone is trying to actively hack(as opposed to various bots that that try to log in as root with password of "password" that exclusively hit ports 22 and 2222).

Firstly, a key concept here is attack surface. If you only have SSH and Apache with a static website running, and all other ports are blocked by firewall, then there just isn't much that can be exploited even if there are vulnerabilities that haven't been patched yet. If you have PHP, SQL and Wordpress running, then suddenly there are a lot more attacks that can be successfully executed if any of them are vulnerable. And as the attack surface grows - as you have more programs running and more services that can be accessed(directly or indirectly) - the probability of there being an exploit that can be used to target your server grows.

Secondly, you have to consider the threat model: Who is trying to hack into your server and why? Apart from the aforementioned bots(which, as noted, are generally foiled just by following reasonably good password practices and not using default usernames like root, admin, etc.), who would try to get into your server? Hacking people takes time, and most people who do it just for fun prefer doing it legally. If you have a personal website that gets a couple dozen visitors per day, there isn't much to be gained from hacking it(if, on the other hand, you're running the website for a large corporation, you need to seriously consider the threat of someone spending a lot of effort to gain access to your system).

Thirdly, updates are typically not as time critical as you seem to think. Yes, there are zero-day exploits in the wild and sometimes a vulnerability can be exploited very quickly, but even if a vulnerability is known it takes time to develop an exploit - and in many cases, the exploits will only be known by the developers and a few security researchers until a patch has been developed and is ready to be deployed. So even if you don't patch instantly, it's unlikely that anyone could exploit the particular vulnerability within a few days(unless it's one for which a zero-day exploit is known).

In conclusion, while it's almost certainly possible for your server to get hacked within a few days, as long as you follow reasonable security practices(and aren't being specifically targeted by malicious actors) it's very unlikely to happen just because it took you a day or two to apply the latest security patches.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .