I've been reading into the Meltdown and Spectre bugs recently and the issues they cause for virtualised servers, as memory in one VM can potentially be accessed by another user in a separate VM with the same host.
I found this article on DigitalOcean (here), where they talk about making sure to apply new kernel patches to servers to help mitigate the effects of the bugs. In the comments I see people talking about protecting their server droplets (DigitalOcean's brand of VPSs) this way, and that's where I got confused. Surely any security updates applied on their VM will not affect the execution of the bug in another VM on an older OS update? When an attacker on the same host is on an old version of an OS wouldn't they be able to exploit the bugs just fine, as they're the ones executing the code required, not the updated VM they are trying to retrieve memory from?
So my question is, am I correct in thinking that there is no way the bugs can be mitigated this way for virtual servers? If so, are virtual servers going to remain unsecure for a long time to come?